helps generate an XQL to notify when a USB is connected

Rolando_Pena — Tue, 11 Jun 2024 16:59:04 GMT

I am trying to use Cortex XDR so that when a user connects a USB storage device I receive a notification by email.

so far I have used this XQL:

preset = device_control
| filter event_sub_type = ENUM.DEVICE_PLUG

which tells me when any USB device is connected to the endpoints, I added this as a BIOC rule so that when the condition is met it generates an alert.

and based on the BIOC the alert is generated, which I use as a basis for an automatic email sending rule. This works fine, and I get email notifications when a USB device is connected.

The issue is that it does not make a distinction between storage devices and other devices such as mice, headphones, Ethernet adapters, printers. Everything that connects via USB generates a notification.

How can I change the XQL so that it only shows me the USB storage devices or external drives that are connected but not others such as printers or headphones?

Re: helps generate an XQL to notify when a USB is connected

Parksam — Tue, 11 Jun 2024 17:15:58 GMT

You can try filtering by drive_type. I believe drive_type = 2 is removable media.

Re: helps generate an XQL to notify when a USB is connected

A.Elzedy — Tue, 10 Jun 2025 17:38:23 GMT

Hi @Rolando_Pena ,

Here's a query that should help you out with filtering those USB storage devices! I've added some smart filtering to catch only the actual storage devices (flash drives, external drives, etc.) while filtering out all those mice, keyboards, headphones, and printers that were cluttering up your alerts. Feel free to tweak it based on what works best in your environment - every organization has their own mix of devices, so you might need to adjust the filters a bit to get it just right.

preset = device_control | filter event_sub_type = ENUM.DEVICE_PLUG // ===== STORAGE DEVICE IDENTIFICATION ===== | filter ( // Primary storage device class identifiers action_device_class_name contains "Mass Storage" or action_device_class_name contains "Disk" or action_device_class_name contains "Storage" or // USB storage device class GUIDs action_device_class_guid in ( "{4D36E967-E325-11CE-BFC1-08002BE10318}", // Disk drives "{53F56307-B6BF-11D0-94F2-00A0C91EFB8B}", // Battery devices (some USB drives) "{71A27CDD-812A-11D0-BEC7-08002BE2092F}" // Volume devices ) or // Device interface class for storage action_device_class_name contains "USB Mass Storage" or // Product name indicators for storage devices (action_device_usb_product_name contains "Flash" or action_device_usb_product_name contains "Drive" or action_device_usb_product_name contains "Storage" or action_device_usb_product_name contains "Disk" or action_device_usb_product_name contains "USB" and action_device_usb_product_name contains "Memory") or // Vendor-specific storage device patterns (action_device_usb_vendor_name in ("SanDisk Corp.", "Kingston", "Samsung", "Toshiba", "Western Digital", "Seagate") and not (action_device_usb_product_name contains "Mouse" or action_device_usb_product_name contains "Keyboard" or action_device_usb_product_name contains "Audio")) ) // ===== EXCLUDE NON-STORAGE DEVICES ===== | filter not ( // Exclude input devices action_device_class_name contains "Mouse" or action_device_class_name contains "Keyboard" or action_device_class_name contains "HID" or action_device_class_guid = "{745A17A0-74D3-11D0-B6FE-00A0C90F57DA}" or // HID class // Exclude audio devices action_device_class_name contains "Audio" or action_device_class_name contains "Sound" or action_device_class_name contains "Headphone" or action_device_class_guid = "{4D36E96C-E325-11CE-BFC1-08002BE10318}" or // Sound devices // Exclude network devices action_device_class_name contains "Network" or action_device_class_name contains "Ethernet" or action_device_class_name contains "WiFi" or action_device_class_guid = "{4D36E972-E325-11CE-BFC1-08002BE10318}" or // Network adapters // Exclude printers and imaging action_device_class_name contains "Printer" or action_device_class_name contains "Scanner" or action_device_class_name contains "Image" or action_device_class_guid = "{4D36E979-E325-11CE-BFC1-08002BE10318}" or // Printer devices // Exclude cameras and video devices action_device_class_name contains "Camera" or action_device_class_name contains "Video" or action_device_class_guid = "{6BDD1FC6-810F-11D0-BEC7-08002BE2092F}" or // Imaging devices // Exclude mobile devices/phones (if not considered storage) action_device_class_name contains "Phone" or action_device_class_name contains "Mobile" or // Exclude USB hubs and controllers action_device_class_name contains "Hub" or action_device_class_name contains "Controller" or action_device_class_guid = "{36FC9E60-C465-11CF-8056-444553540000}" // USB devices (controllers) ) // ===== ADDITIONAL STORAGE VERIFICATION ===== | alter storage_confidence = if( action_device_class_name contains "Mass Storage" or action_device_class_name contains "Disk", "🔴 HIGH_CONFIDENCE_STORAGE", action_device_usb_product_name contains "Flash" or action_device_usb_product_name contains "Drive", "🟠 MEDIUM_CONFIDENCE_STORAGE", action_device_usb_vendor_name in ("SanDisk Corp.", "Kingston", "Samsung"), "🟡 VENDOR_BASED_STORAGE", "✅ LIKELY_STORAGE_DEVICE" ), device_summary = concat( coalesce(action_device_usb_vendor_name, "Unknown Vendor"), " - ", coalesce(action_device_usb_product_name, "Unknown Product") ) // ===== OUTPUT FOR BIOC RULE ===== | fields _time, agent_hostname, agent_ip_addresses, action_device_usb_vendor_name, action_device_usb_product_name, action_device_usb_serial_number, action_device_class_name, action_device_class_guid, storage_confidence, device_summary | sort desc _time

topic Re: helps generate an XQL to notify when a USB is connected in General Topics

helps generate an XQL to notify when a USB is connected

Re: helps generate an XQL to notify when a USB is connected

Re: helps generate an XQL to notify when a USB is connected