1 Reply Latest reply on Aug 31, 2016 11:06 AM by jhynds

    USB Defender - RW & Modify detection/action

    jdgrimm82

      Within LEM, is it possible to create a rule that will notify an email list when someone copies or modifies a PST or EXE file to or from a USB drive?

        • Re: USB Defender - RW & Modify detection/action
          jhynds

          Hey,

           

          You will need to install the LEM Agent & USB Defender on each machine you want to monitor. When a user copies a file to a USB it generally appears as a FileCreate event like below. If they modify the file it will probably appear as a FileWrite event.

           

           

          You could create a rule something like this:

           

           

          I haven't tested that rule, but something along those lines should do the trick