Hello,
I currently have USB blocking in place and have a whitelist for authorized USB devices. My problem is when I add a USB device to the whitelist it is usable on all machines. How do I restrict it to one machine?
Thanks,
David
Create a UDG with the DetectionIP of the one machine. Create a UDG with only the whitelisted device. Add a new AND Group to your Correlations box that contains [DetectionIP does not contain the UDG with that machine] AND the [ExtraneousInfo does not contain the UDG that has the USB of that whitelisted device].
