Its possibele to see which are the endpoint accesing usb

[RajeshPremSingh]

By default, we block USB access. However, if there's a specific need, we grant access. Is there a way to monitor if an endpoint is attempting to access USB without authorization?

[PiyushKohli]

Hi @RajeshPremSingh 

Thank you for reaching out to Palo Alto Live Community. 

If I understand correctly you want to monitor USB Plug in events, if this is the case you may use couple of options as shared below.

1. If Device Configuration Profile is applied and Extension Policy is applied to the endpoint. In this case you may look for events under XDR Dataset or Preset device control using following XQL query and you may further improvise the query based on your requirements. 

dataset = xdr_data
| filter event_type = ENUM.DEVICE and event_sub_type = ENUM.DEVICE_PLUG

OR
preset = device_control
| filter event_type = ENUM.DEVICE and event_sub_type = ENUM.DEVICE_PLUG

2. If extension Policy is not applied on the endpoint.

dataset = xdr_data
| filter event_type = ENUM.MOUNT and event_sub_type = ENUM.MOUNT_DRIVE_MOUNT 
| alter storagedevicedrivetype = action_mount_device_info -> storage_device_drive_type{}
| filter storagedevicedrivetype = "2" {This is for USB Drive}

Feel free to write back if you have further query.

Hope this helps!

Please mark the response as "Accept as Solution" if it answers your query.