> For the complete documentation index, see [llms.txt](https://docs.stoik.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.stoik.io/mdr/deploy/crowdstrike/add-on/device-control.md).

# Device Control

Control the use of USB devices (USB keys, hard drives, etc.) with a USB device **Policy**: general rules that allow or block USB devices based on their class. The Stoïk team can set it up for you, or you can configure it yourself in the CrowdStrike console.

## Prerequisites

* For self-service setup: **Device Control Manager** access to your CrowdStrike console. Request it by emailing <protect@stoik.io>.

## Scope

You can:

* Configure rules by device type.
* Implement them using CrowdStrike Policies, either yourself or through the Stoïk SOC.
* Configure exclusions (workstation, device).
* Manage them with the `Device Control Manager` user right.

Configuration by endpoint is not possible: it would require assigning each endpoint to specific **groups**.

For example, you can create a policy to block USB storage devices while allowing access to other USB device classes.

## Deployment

{% tabs %}
{% tab title="Stoïk team" %}

#### Define your control objectives

Determine what you want to enforce:

* Block all USB devices
* Set devices to read-only
* Allow only specific models
* Monitor / audit usage without blocking (observation mode)

#### Inventory of authorized or blocked devices

For each USB device you want to allow or block:

1. Plug it into a workstation.
2. Retrieve its hardware identifiers, either:
   * Via the graphical interface: `Device Manager` > USB device > right-click > `Properties` > `Details` > `Hardware IDs`.
   * Via PowerShell:

     ```powershell
     Get-PnpDevice -PresentOnly | Where-Object { $_.Class -eq "USB" }
     ```
3. Send the following information to <protect@stoik.io>:
   * Vendor ID (VID)
   * Product ID (PID)
   * Serial number (if applicable)

#### Stoïk team configuration

A Stoïk cybersecurity engineer configures the rules and informs you once the setup is complete.
{% endtab %}

{% tab title="Self-service" %}
This option requires **Device Control Manager** access, see [Prerequisites](#prerequisites).

#### Create and configure the policy

1. Go to `Endpoint Security` > `USB Device Control` > [`Policies`](https://falcon.eu-1.crowdstrike.com/policies/device-control).
2. Click `Create policy`, enter a name and optional description, then click `Create policy` to confirm.
3. In the `Settings` tab:
   * Select the mode (`Monitor`, `Monitor and enforce`, or `Off` for macOS only).
   * Enable the desired USB settings.
   * Select the notification to inform end users when a USB device is fully blocked.
   * Select the notification to inform end users when a USB device is restricted.
4. In the `USB Device` tab, expand each device class to include, choose the authorization level, and add exceptions per class if needed by clicking `Add exception`.

The three modes work as follows:

* **Monitor and enforce**: actively applies defined rules, blocks or allows USB connections and logs activity.
* **Monitor only**: logs connections without enforcing restrictions. Ideal for testing policies without disrupting users.
* **Off (macOS only)**: completely disables Device Control. No activity is logged or blocked.

{% hint style="info" %}
Using **Monitor only** is an effective way to establish a list of USB devices typically used by your employees, which can then serve as the basis for a future allowlist.
{% endhint %}

<figure><img src="https://25674881.fs1.hubspotusercontent-eu1.net/hubfs/25674881/Screenshot%202025-08-20%20at%2009-58-35-png.png" alt=""><figcaption></figcaption></figure>

<figure><img src="https://25674881.fs1.hubspotusercontent-eu1.net/hubfs/25674881/Screenshot%202025-08-20%20at%2009-59-34-png.png" alt=""><figcaption></figcaption></figure>

#### Activate the policy

1. Click `Save` in the top-right corner, then `Save` again to confirm.
2. In the `Assigned host groups` tab, click `Assign host groups to policy`.
3. Click `Enable policy`.

To speed up configuration of similar policies, click `Duplicate policy` to create an exact copy.
{% endtab %}
{% endtabs %}

## Policy deployment

{% tabs %}
{% tab title="Windows" %}
Device policies are applied as soon as a USB device is connected to a host. If USB devices are already connected at the time the policy is assigned, they will only be affected upon their next reconnection or the next host reboot.
{% endtab %}

{% tab title="macOS" %}
Device policies are applied as soon as a USB or Bluetooth device is connected to a host. If devices are already connected at the time the policy is assigned, the policy takes effect immediately. If the policy blocks the device, it will be disconnected.
{% endtab %}
{% endtabs %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.stoik.io/mdr/deploy/crowdstrike/add-on/device-control.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.