Tracking Program Use with SEM

I am pretty sure there is no native way to do this, so you need to get creative. It pretty much goes into a direction that you already went by checking "can I utilize the processes started by the tool" to check that. SEM is pretty much an "aggregation for all sort of logs/info" the applications and monitored devices need to provide the logs. The tricky part is always to find out how each specific app presents different statusses/logs etc.

Is this only one specific CD-Burning solution? This would make life easier as you could check the vendor's guides what the software can provide as output and what not.

If it's a generalistic approach it might not be doable as we do not know how each CD-Burning tool loggs/presents data.

I know this is a pretty generic answer, unfortunately this is how SEM works...

This is unfortunately what we feared. We're working on a DLP solution for just that, but I've been tasked with finding a solution if possible through SEM. I'll refine it as much as I can, but I'm happy to know there isn't anything key I'm missing. 

Thank you for the response. 

Are you using the workstation agent on those machines, and do you have FIM activated on those. might be possible to capture write sessions onto a CD-Drive and alert on this, but I have not looked too deep into this yet.

We currently have the agent installed on each machine. I've compared the events generated while burning a CD, and looked into some of the different event types like FileWrite, FileExecute, FileMove, etc. Nothing seems to do the trick with how we have it set up.

If it is a DLP solution, are your trying to prevent it from happening? Could you disable DVD/CD drives and external peripherals that aren't mice/keyboards? This would prevent needing to monitor when this is tried as it simply wouldn't be possible. Have dedicated machines to do the burning if it is a valid need?

We currently have all drives and removable media locked down. But we need a way to track that when users do burn things (through an elevated account with privileges), we can see exactly how much they're burning and what it is. 

Makes sense.

A thought that may work would be to see if running Sysmon to monitor would give events with enough information to track it.

If not Sysmon, maybe Process Monitor to right to a backing file anything from the burning software EXE and then using something (I am partial to PowerShell) to read the backing file and put relevant information into event logs. Then SEM could read those events.

Sysinternals - Sysinternals | Microsoft Learn