topic Re: Query users that use USB device in Cortex XDR Discussions

Query users that use USB device

RodrigoBarroso — Mon, 22 Jan 2024 05:39:06 GMT

Hello.

I've try to obtain a list of all users that use USB device in his computers.

All corporate computer have XDR installed, any query suggestion?

Regards.

Rodrigo

JayGolf — Wed, 24 Jan 2024 05:36:39 GMT

I am moving your post to the Cortex-XDR discussion board.

jmazzeo — Wed, 24 Jan 2024 15:08:17 GMT

Hi @RodrigoBarroso , thanks for reaching us using the Live Community.

Maybe this XQL Query can help you to gather the information of device plus on the endpoints:

preset = device_control
| filter event_sub_type = ENUM.DEVICE_PLUG
| dedup action_device_usb_serial_number by desc agent_hostname

Let me know how it goes.