helps generate an XQL to notify when a USB is connected

[Rolando_Pena]

I am trying to use Cortex XDR so that when a user connects a USB storage device I receive a notification by email.

so far I have used this XQL:

preset = device_control
| filter event_sub_type = ENUM.DEVICE_PLUG

which tells me when any USB device is connected to the endpoints, I added this as a BIOC rule so that when the condition is met it generates an alert.

and based on the BIOC the alert is generated, which I use as a basis for an automatic email sending rule. This works fine, and I get email notifications when a USB device is connected.

The issue is that it does not make a distinction between storage devices and other devices such as mice, headphones, Ethernet adapters, printers. Everything that connects via USB generates a notification.

How can I change the XQL so that it only shows me the USB storage devices or external drives that are connected but not others such as printers or headphones?

Cortex XDR  

[Parksam]

You can try filtering by drive_type. I believe drive_type = 2 is removable media.

[A.Elzedy · Accepted solution]

Hi @Rolando_Pena ,

Here's a query that should help you out with filtering those USB storage devices! I've added some smart filtering to catch only the actual storage devices (flash drives, external drives, etc.) while filtering out all those mice, keyboards, headphones, and printers that were cluttering up your alerts. Feel free to tweak it based on what works best in your environment - every organization has their own mix of devices, so you might need to adjust the filters a bit to get it just right.

preset = device_control 
| filter event_sub_type = ENUM.DEVICE_PLUG

// ===== STORAGE DEVICE IDENTIFICATION =====
| filter (
    // Primary storage device class identifiers
    action_device_class_name contains "Mass Storage" or
    action_device_class_name contains "Disk" or
    action_device_class_name contains "Storage" or
    
    // USB storage device class GUIDs
    action_device_class_guid in (
        "{4D36E967-E325-11CE-BFC1-08002BE10318}",  // Disk drives
        "{53F56307-B6BF-11D0-94F2-00A0C91EFB8B}",  // Battery devices (some USB drives)
        "{71A27CDD-812A-11D0-BEC7-08002BE2092F}"   // Volume devices
    ) or
    
    // Device interface class for storage
    action_device_class_name contains "USB Mass Storage" or
    
    // Product name indicators for storage devices
    (action_device_usb_product_name contains "Flash" or
     action_device_usb_product_name contains "Drive" or
     action_device_usb_product_name contains "Storage" or
     action_device_usb_product_name contains "Disk" or
     action_device_usb_product_name contains "USB" and 
     action_device_usb_product_name contains "Memory") or
    
    // Vendor-specific storage device patterns
    (action_device_usb_vendor_name in ("SanDisk Corp.", "Kingston", "Samsung", "Toshiba", "Western Digital", "Seagate") and
     not (action_device_usb_product_name contains "Mouse" or 
          action_device_usb_product_name contains "Keyboard" or
          action_device_usb_product_name contains "Audio"))
)

// ===== EXCLUDE NON-STORAGE DEVICES =====
| filter not (
    // Exclude input devices
    action_device_class_name contains "Mouse" or
    action_device_class_name contains "Keyboard" or
    action_device_class_name contains "HID" or
    action_device_class_guid = "{745A17A0-74D3-11D0-B6FE-00A0C90F57DA}" or  // HID class
    
    // Exclude audio devices
    action_device_class_name contains "Audio" or
    action_device_class_name contains "Sound" or
    action_device_class_name contains "Headphone" or
    action_device_class_guid = "{4D36E96C-E325-11CE-BFC1-08002BE10318}" or  // Sound devices
    
    // Exclude network devices
    action_device_class_name contains "Network" or
    action_device_class_name contains "Ethernet" or
    action_device_class_name contains "WiFi" or
    action_device_class_guid = "{4D36E972-E325-11CE-BFC1-08002BE10318}" or  // Network adapters
    
    // Exclude printers and imaging
    action_device_class_name contains "Printer" or
    action_device_class_name contains "Scanner" or
    action_device_class_name contains "Image" or
    action_device_class_guid = "{4D36E979-E325-11CE-BFC1-08002BE10318}" or  // Printer devices
    
    // Exclude cameras and video devices
    action_device_class_name contains "Camera" or
    action_device_class_name contains "Video" or
    action_device_class_guid = "{6BDD1FC6-810F-11D0-BEC7-08002BE2092F}" or  // Imaging devices
    
    // Exclude mobile devices/phones (if not considered storage)
    action_device_class_name contains "Phone" or
    action_device_class_name contains "Mobile" or
    
    // Exclude USB hubs and controllers
    action_device_class_name contains "Hub" or
    action_device_class_name contains "Controller" or
    action_device_class_guid = "{36FC9E60-C465-11CF-8056-444553540000}"     // USB devices (controllers)
)

// ===== ADDITIONAL STORAGE VERIFICATION =====
| alter 
    storage_confidence = if(
        action_device_class_name contains "Mass Storage" or 
        action_device_class_name contains "Disk", "🔴 HIGH_CONFIDENCE_STORAGE",
        
        action_device_usb_product_name contains "Flash" or
        action_device_usb_product_name contains "Drive", "🟠 MEDIUM_CONFIDENCE_STORAGE",
        
        action_device_usb_vendor_name in ("SanDisk Corp.", "Kingston", "Samsung"), "🟡 VENDOR_BASED_STORAGE",
        
        "✅ LIKELY_STORAGE_DEVICE"
    ),
    
    device_summary = concat(
        coalesce(action_device_usb_vendor_name, "Unknown Vendor"), " - ",
        coalesce(action_device_usb_product_name, "Unknown Product")
    )

// ===== OUTPUT FOR BIOC RULE =====
| fields 
    _time,
    agent_hostname,
    agent_ip_addresses,
    action_device_usb_vendor_name,
    action_device_usb_product_name,
    action_device_usb_serial_number,
    action_device_class_name,
    action_device_class_guid,
    storage_confidence,
    device_summary

| sort desc _time