1 Reply Latest reply on Aug 31, 2016 11:06 AM by jhynds

    USB Defender - RW & Modify detection/action


      Within LEM, is it possible to create a rule that will notify an email list when someone copies or modifies a PST or EXE file to or from a USB drive?

        • Re: USB Defender - RW & Modify detection/action



          You will need to install the LEM Agent & USB Defender on each machine you want to monitor. When a user copies a file to a USB it generally appears as a FileCreate event like below. If they modify the file it will probably appear as a FileWrite event.



          You could create a rule something like this:



          I haven't tested that rule, but something along those lines should do the trick