I am creating a whitelist of USBs and have a few questions.
First, almost all of the example rules I have seen only contain SystemStatus.EventInfo = *attached* and do not include SystemStatus.EventInfo = "USB Input"
Is there a reason why others have left off these USB alerts?
Also when trying to add the USB Input IDs to the Authorized USB Thumb Drives group, I realized that USB Input alerts have & in them instead of just &
Example of USB attached: USB\VID_0000&PID_0000\0&00000000&0&0
Example of USB Input: USB\VID_0000&PID_0000\0&00000000&0&0
Is there a reason for this, and how should I enter these values into the Authorized USB list?
