- Access exclusive content
- Connect with peers
- Share your expertise
- Find support resources
10-13-2023 05:23 AM
By default, we block USB access. However, if there's a specific need, we grant access. Is there a way to monitor if an endpoint is attempting to access USB without authorization?
10-15-2023 08:11 PM
Thank you for reaching out to Palo Alto Live Community.
If I understand correctly you want to monitor USB Plug in events, if this is the case you may use couple of options as shared below.
1. If Device Configuration Profile is applied and Extension Policy is applied to the endpoint. In this case you may look for events under XDR Dataset or Preset device control using following XQL query and you may further improvise the query based on your requirements.
dataset = xdr_data
| filter event_type = ENUM.DEVICE and event_sub_type = ENUM.DEVICE_PLUG
OR
preset = device_control
| filter event_type = ENUM.DEVICE and event_sub_type = ENUM.DEVICE_PLUG
2. If extension Policy is not applied on the endpoint.
dataset = xdr_data
| filter event_type = ENUM.MOUNT and event_sub_type = ENUM.MOUNT_DRIVE_MOUNT
| alter storagedevicedrivetype = action_mount_device_info -> storage_device_drive_type{}
| filter storagedevicedrivetype = "2" {This is for USB Drive}
Feel free to write back if you have further query.
Hope this helps!
Please mark the response as "Accept as Solution" if it answers your query.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!