Within LEM, is it possible to create a rule that will notify an email list when someone copies or modifies a PST or EXE file to or from a USB drive?
Hey,
You will need to install the LEM Agent & USB Defender on each machine you want to monitor. When a user copies a file to a USB it generally appears as a FileCreate event like below. If they modify the file it will probably appear as a FileWrite event.
You could create a rule something like this:
I haven't tested that rule, but something along those lines should do the trick
