Devices & Groups

The Devices & Groups section allows you to map MAC addresses and IP addresses to device names and also group them together. This allows you to easily reference devices or groups of devices in USS products that support them, such as the Web Security product Filter Rules section.

Managing Groups

To access the Devices & Groups section, visit your USS Dashboard and click Products ⟶ Settings ⟶ Devices & Groups.

The list of available groups is on the left. By default, the list will be empty.

Adding Groups

To add a new Group, click the button and add a name for the new group. Click .

Updating Groups

To edit a Group, double-click it in the left-hand panel. Make any required changes, and then click .

Removing Groups

Removing a Group will remove it from any rules that reference the category and will also remove all the patterns that belong to the category.

To delete an existing Group select it in the tree and then click the button.

Managing Devices

In the context of Device Groups, devices simply represent IP addresses or MAC addresses.

Adding Devices

To add a new device, first select a Group from the left-hand panel, and then click .

Hostname

The hostname of the device.

MAC address

A valid MAC address (for example, AA:BB:CC:DD:EE:00)

IP address (v4)

If the address is in IPv4 format, enter it here.

IP address (v6)

If the address is in IPv6 format, enter it here.

Comment

An optional comment.

Click to create the new Device. It will be listed under the chosen Group.

Updating Devices

To edit a Device, double-click it in the right-hand panel. Make any required changes, and then click .

Removing Devices

To delete an existing Device, select it and then click the button.

Using Devices in Rules

Devices and Device Groups can be used within Filter Rules in order to match web requests. For example, you may want to block access to certain Cloud Applications or websites if the device connecting is from the guest network.

To make use of this functionality, select the Devices or Device Groups option from the list of Conditions when creating a Rule.

Importing Devices

Importing Devices from CSV

  1. From the drop-down, choose CSV.
You can use a PowerShell script example to export device information from Active Directory.
  1. Select the Device Group to import the device information into.
  2. Select whether to add the new entries to the group, or overwrite the entries in the selected group during import.
  3. Paste in a list of devices in the specified CSV format
hostname, MAC address, IPv4 address.

The entries will be validated for errors. To view errors, hover over the entry window and review the tooltip. Make the changes and try again.

  1. Click Import to add the devices to the selected category.

Importing Devices by IP Range

  1. From the drop-down, choose CSV.
  2. Select the Device Group to import the device information into.
  3. Select whether to add the new entries to the group, or overwrite the entries in the selected group during import.
  4. Enter a starting IP and an ending IP. All IP addresses within this range will be imported.

Importing Devices by CIDR

  1. From the drop-down, choose CIDR.
  2. Select the Device Group to import the device information into.
  3. Select whether to add the new entries to the group, or overwrite the entries in the selected group during import.
  4. Enter a CIDR to import.

PowerShell script to extract device information from Active Directory

The following PowerShell script will attempt to export device information from Active Directory and write it out to a CSV file in c:\temp\computers.csv. This can then be used to import into USS via the CSV option. The script can be run using the PowerShell ISE application.

You may need to update the script to change the output path of the CSV.
$computers = Get-ADComputer -Filter * -Properties ipv4Address, DNSHostName
$results=@()

ForEach($comp in $computers) {
   if($comp.IPv4Address.length -gt 0) {
    
        write-host "Querying $($comp.name) - $($comp.ipv4Address)..."

        $test = Test-Connection -Computername $comp.name -BufferSize 16 -Count 1 -Quiet
    
        if ($test -eq "true") {
        
            $mac = & arp.exe -a $($comp.IPv4Address).ToString() | Select-String $($comp.IPv4Address).ToString() |% { ($_.toString().Trim() -split '\s+')[1] }
        
            if ($mac) {
                if ($mac.substring(2,1) -eq "-") {
                    $addr = $mac.replace("""","")
                    $mac = $addr.replace("-",":")
                    $results += "$($comp.name),$mac,$($comp.IPv4Address)"
                }
            }
      
        } else {
            write-Host "Skipping unreachable PC $($comp.name)"
        }

    }

}
echo "================================"
echo "Found $($results.Count) devices"
echo "Written to c:\temp\computers.csv"
echo "================================"

$results | Out-File "c:\temp\computers.csv"

How did we do?