- Access exclusive content
- Connect with peers
- Share your expertise
- Find support resources
01-21-2024 09:39 PM
Hello.
I've try to obtain a list of all users that use USB device in his computers.
All corporate computer have XDR installed, any query suggestion?
Regards.
Rodrigo
01-23-2024 09:36 PM
Hi @SoporteCiber ,
I am moving your post to the Cortex-XDR discussion board.
01-24-2024 07:08 AM
Hi @SoporteCiber , thanks for reaching us using the Live Community.
Maybe this XQL Query can help you to gather the information of device plus on the endpoints:
preset = device_control
| filter event_sub_type = ENUM.DEVICE_PLUG
| dedup action_device_usb_serial_number by desc agent_hostname
Let me know how it goes.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!