topic Re: usb usage in Cortex XDR Discussions

usb usage

RajeshPremSingh — Tue, 23 May 2023 00:16:29 GMT

Is there a feature in Cortex that allows us to monitor which endpoints use USB to transfer data?

Re: usb usage

bbarmanroy — Tue, 23 May 2023 05:44:16 GMT

hi @RajeshPremSingh how about a XQL query to start off with the investigation?

dataset = xdr_data // Using the xdr dataset
| filter event_type=FILE and event_sub_type = ENUM.FILE_WRITE and action_file_size != null //filter out 0 byte files

From the results, can you identify out the device information and share some results (redacting any secrets)?

Re: usb usage

RajeshPremSingh — Wed, 24 May 2023 23:47:50 GMT

The displayed results pertain to application data usage rather than USB data usage. I am specifically looking for an endpoint that is utilizing USB.