helps generate an XQL to notify when a USB is connected

[Rolando_Pena]

I am trying to use Cortex XDR so that when a user connects a USB storage device I receive a notification by email.

so far I have used this XQL:

preset = device_control
| filter event_sub_type = ENUM.DEVICE_PLUG

which tells me when any USB device is connected to the endpoints, I added this as a BIOC rule so that when the condition is met it generates an alert.

and based on the BIOC the alert is generated, which I use as a basis for an automatic email sending rule. This works fine, and I get email notifications when a USB device is connected.

The issue is that it does not make a distinction between storage devices and other devices such as mice, headphones, Ethernet adapters, printers. Everything that connects via USB generates a notification.

How can I change the XQL so that it only shows me the USB storage devices or external drives that are connected but not others such as printers or headphones?

Cortex XDR 

[Parksam]

You can try filtering by drive_type. I believe drive_type = 2 is removable media.