Query users that use USB device

[SoporteCiber]

Hello.

I've try to obtain a list of all users that use USB device in his computers.

All corporate computer have XDR installed, any query suggestion?

Regards.

Rodrigo

[JayGolf]

Hi @SoporteCiber ,

I am moving your post to the Cortex-XDR discussion board.

[jmazzeo]

Hi @SoporteCiber , thanks for reaching us using the Live Community.

Maybe this XQL Query can help you to gather the information of device plus on the endpoints:

preset = device_control
| filter event_sub_type = ENUM.DEVICE_PLUG
| dedup action_device_usb_serial_number by desc agent_hostname

Let me know how it goes.