Setting up Endpoint Security Groups

The Endpoint Security default groups are the following:

• Monitor + Remediation — Barracuda XDR monitors your endpoints, notifies you with an Alert if any risks are detected, and isolates and remediates risks. In this group, Class 8 Mass Storage USB devices are blocked from connecting.

• Monitor Only — Barracuda XDR monitors your endpoints and notifies you with an Alert if any risks are detected.

• Monitor + Remediation + USB Allowed — Barracuda XDR monitors your endpoints, notifies you with an Alert if any risks are detected, and isolates and remediates risks. In this group, USB devices are allowed.

• Monitor + Remediation + VSS Disabled — Barracuda XDR monitors your endpoints, notifies you with an Alert if any risks are detected, and isolates and remediates risks. In this group, Volume Shadow Copy Service (VSS) is disabled, which is required for most backup software to run without interference from the SentinelOne agent. If you're running your own backup systems, place your servers in this group to avoid issues right away upon installation.

Groups are created for you by the SOC team. If you want another group made, make a security request.

To allow USB devices to connect for any of these groups, see Blocking and Unblocking USB Storage Drives.

To Review the Endpoint Security Groups

1. In Barracuda XDR Dashboard, click Endpoint Security > Endpoint Devices.

2. In the top right corner of the page, click Groups.

To Add a New Group

• Contact the SOC team.

To Apply an Endpoint Security Group to a Device

1. In Barracuda XDR Dashboard, click Endpoint Security > Endpoint Devices.

2. In the Endpoint Devices table, click the row of the device you want to apply the group to.

3. Click Edit Device.

4. In the Edit Device popup, in Select New Group, select a group.

5. Click the X icon .