General steps

To configure Device Control, use the following general steps:

1. Create a DeviceControlPolicyExtension object and set the properties.
2. Create a PolicySettings object to configure runtime settings of the module.
3. Create a Policy object and add the DeviceControlPolicyExtension and PolicySettings objects.
4. Use a PoliciesApi object to add or update the policy on Deep Security Manager.

Create a DeviceControlPolicyExtension object and set the state and rule IDs:

device_control_policy_extension = api.DeviceControlPolicyExtension()
device_control_policy_extension.state = "on"

Next, create a PolicySettings object to configure Device Control related settings. (For detailed information about policy settings, see Configure policy and default policy settings.) For example, you can block USB mass storage access:

policy_settings = api.PolicySettings()
setting_value = api.SettingValue()
setting_value.value = "Block"
policy_settings.device_control_setting_device_control_usb_storage_device_action = setting_value

At this point, the Device Control policy extension and the policy settings are configured. Next, add them to a Policy object, and use a PoliciesApi object to modify a policy on Deep Security Manager.

policy = api.Policy()
policy.device_control = device_control_policy_extension
policy.policy_settings = policy_settings

policies_api = api.PoliciesApi(api.ApiClient(configuration))
returned_policy = policies_api.modify_policy(policy_id, policy, api_version)

The policy_id (or policyID) parameter of modifyPolicy identifies the actual policy on Deep Security Manager that is to be modified. This policy is modified according to the policy object that is used as the policy parameter. Any properties of the policy parameter that are not set remain unchanged on the actual policy.

Example

The following example creates a Policy object, modifies its DeviceControlPolicyExtension, and configures a policy setting. The policy is then updated on Deep Security Manager.

policies_api = api.PoliciesApi(api.ApiClient(configuration))
policy = api.Policy()
device_control_policy_extension = api.DeviceControlPolicyExtension()

# Turn on Device Control
device_control_policy_extension.state = "on"

# Add the Device Control state to the policy
policy.device_control = device_control_policy_extension

# Create a policy_settings
policy_settings = api.PolicySettings()

# Block USB mass storage access
usb_mass_storage_setting_value = api.SettingValue()
usb_mass_storage_setting_value.value = "Block" # Allow values: Full Access, Read Only, Block
policy_settings.device_control_setting_device_control_usb_storage_device_action = usb_mass_storage_setting_value

# Block USB autorun
usb_autorun_setting_value = api.SettingValue()
usb_autorun_setting_value.value = "Block" # Allow values: Allow, Block
policy_settings.device_control_setting_device_control_auto_run_usb_action = usb_autorun_setting_value

# Block "Mobile (MTP/PTP)" access
mobile_setting_value = api.SettingValue()
mobile_setting_value.value = "Block" # Allow values: Full Access, Read Only, Block
policy_settings.device_control_setting_device_control_mobile_device_action = mobile_setting_value

# Add USB mass storage access to the policy
policy.policy_settings = policy_settings

# Modify the policy on Deep Security Manager
policies_api.modify_policy(policy_id, policy, api_version)

For information about authenticating API calls, see Authenticate with Deep Security Manager.

Create a USB Device Exception

To create a Device Control exception rule:

1. Create a USBDevice object.
2. Add the USB device on Deep Security Manager with USBStorageDevicesApi.
3. Set the USB device to "full-access" with PolicyDeviceControlExceptionRulesApi to a policy.

# Create a new USB device
device = api.USBDevice()
device.name = 'device name'
device.vendor = 'device vendor'
device.model = 'device model'
device.serial_number = 'device serial number'

usb_storage_device_api = api.USBStorageDevicesApi(api.ApiClient(configuration))
created_device = usb_storage_device_api.create_usb_device(device, api_version)

# Configure exception list
exception_rules = api.ExceptionRules([])
exception_rule1 = api.ExceptionRule()
exception_rule1.device_id = created_device.id
exception_rule1.action = "full-access"
exception_rules.exception_rules.append(exception_rule1)

# Set the exception list to policy
policy_id = 1
policy_exception_rule_api = api.PolicyDeviceControlExceptionRulesApi(api.ApiClient(configuration))
policy_exception_rule_api.set_exception_rules_on_policy(policy_id, exception_rules, api_version)