File writes to usb

I can help you with this, but I am wondering if you are considering the entire scenario. I assume that you want to be alerted when someone who is leaving the organization is attempting to take company data with them, correct? Are you only interested in USB devices? What about cloud storage? What about burnable cd/dvds? How about E-Mail? I only ask because maybe you want to make the rule a little tighter than just USB devices? Then again, maybe not. Let me know and I'll work up the rule for you.

This should give you a good starting point. It's not going to measure the amount of files copied, but you can modify the actions as you see fit. This rule will actually prevent the file copy execution, send a pop-up message, and notify via E-Mail. Let me know should you need further assistance.

Thanks for the reply

I think we are covered on the other methods at the perimeter, its just USB I want to log.

Any help really would be appreciated.

Are you able to see the screenshot of the rule above?

Hi yes I can

Ill play around with them and see what data I get

Thanks

do you know where I get the members of Leavers AD group part from?

Yes I do. So you'll need to create your LEAVERS group in AD. Then from the LEM console, click on Build >> Groups from the top menu:

Then click on the gear in the upper right and click Directory Service Group

Then find the group in the lower left:

Once you have the group built, you can add it to your rule under Directory Service Groups

That's it Fantastic!

Thanks so much for that

Anytime!