Sending USB Alerts via syslog (Cortex XDR)

[Y.SONG464633]

Hello,

We have received a request asking whether it is possible for administrators to receive alert emails whenever a USB device is connected to any endpoints.
(*Currently, the USB policy in Exploit – Device Configuration is set to Read Only.)

(* I think the adminster wants to get the log [Inventory-Device Control Violations])

We attempted to configure this under Settings → Configuration → Notifications by selecting Management Audit Logs and setting the Type to Device Control (All). However, the expected alerts were not generated as desired.

ChatGPT suggested using XQL + BIOC, but we are still unable to identify the exact XQL query and the correct configuration steps.

We have created the query below; however, we are not sure whether it is correct.

Could you please review it and let us know if it is properly configured?

At present, the alert flow is configured as Issue Alert → Syslog → Administrator, so it would be sufficient if USB-related alerts could be forwarded via syslog.

Thank you.

Cortex XDR 

[susekar · Accepted solution]

Hello @Y.SONG464633 ,

Greetings for the day.

It is possible to receive email or syslog notifications whenever a USB device is connected to an endpoint, but the configuration you attempted under Management Audit Logs failed because those logs are designed to track administrative changes (such as an admin modifying a policy), not endpoint security events.

To achieve USB connection notifications, you must create a Correlation Rule based on an XQL query that detects USB connection events and then configure Notification Forwarding for those alerts.

1. Verify Prerequisites

• License: A Cortex XDR Pro license is required to access the granular endpoint telemetry needed for these queries.

• Data Collection: Ensure that Enhanced Endpoint Data collection is enabled in your Agent Settings Profile.

2. Configure the XQL Query

While monitoring registry keys can work, it is more efficient and reliable to use the dedicated DEVICE event type or the built-in device control telemetry.

Recommended XQL Query:

dataset = xdr_data
| filter event_type = DEVICE and event_sub_type = DEVICE_PLUG
| fields _time, agent_hostname, actor_effective_username, action_device_usb_vendor_name, action_device_usb_product_name, action_device_usb_serial_number

3. Create a Correlation Rule

1. Navigate to Detection Rules → Correlation Rules → + New Rule.

2. Paste the recommended query into the XQL Search section.

3. Time Schedule: Configure the rule to run frequently (for example, every 5 or 15 minutes).

4. Action: Select Generate Alert.

5. Alert Name: Assign a unique name such as USB_Connection_Detected. This is important for notification filtering.

6. Alert Fields Mapping (Optional): Map fields such as agent_hostname to standard alert fields for improved visibility.

7. Save and enable the rule.

4. Configure Notification Forwarding (Email or Syslog)

1. Navigate to Settings → Configuration → Notifications → Forwarding Configurations.

2. Click + Add Forwarding Configuration.

3. Alert Source: Select Cortex XDR Analytics & Correlation.

4. Filtering: Filter on the Alert Name created earlier (for example, USB_Connection_Detected).

5. Target: Choose Email or Syslog (ensure the syslog server is already configured under Settings → Configurations → Integrations → Syslog).

6. Save the configuration.

Why BIOC Did Not Work

BIOC (Behavioral Indicators of Compromise) rules are primarily designed for real-time detection and prevention of malicious activity. While they can technically detect USB-related events, Correlation Rules are better suited for monitoring environmental or operational events such as hardware connections. They allow scheduled searches across historical raw data and provide simpler alerting and notification workflows.

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution".

Thanks & Regards,
S. Subashkar Sekar

[Y.SONG464633]

Thank you Veeeeeeeeeeeeeeeeeeeeeeeeeeeeery Much!!

You save my life! 😭😭😭😭😭😭 😘