> For the complete documentation index, see [llms.txt](https://docs.sec1.io/user-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.sec1.io/user-docs/10-siem-edr-xdr/device-control.md).

# Device Control

Device control lets you see the USB and peripheral devices connected to your hosts and decide which are allowed. It is managed under **Manage → Device & Application Control**. Per-host devices also appear on the **Devices** tab of an endpoint.

## Device inventory

The agent reports the peripherals it sees on each host — USB storage, input devices and other connected hardware — so you have an inventory of what is plugged in across the fleet.

## Approve or block a device

For any reported device you can **approve** it (leave it usable) or **block** it. When you block a device, the agent enforces the block on the host by disabling the device:

* **Linux** — the agent revokes the device through USB authorization (the kernel's per-device authorization control), which de-authorizes the device so it cannot be used.
* **Windows** — the agent disables the device using `Disable-PnpDevice`, taking it offline at the OS level.

{% hint style="warning" %}
**macOS:** device inventory is reported, but on-host block enforcement is not available on macOS. Treat macOS device control as visibility only.
{% endhint %}

## Notes

* Enforcement requires the agent to be running with elevated privileges (root on Linux, Admin on Windows). A per-user install cannot disable devices.
* Blocking a device disables it on the host; re-approving allows it to be used again.