process monitor filter usb activity how to

While it’s possible to ingest the data through the Splunk Add-On for Windows, doing so without the add-on will require exporting the log as a text file, where the fields were separated by Tab. Perform a series of tests (inserting and removing USB devices), and generate a log full of events to be exported. Western Digital External Hard Drive Micro USBĭifferent devices should produce different results, especially when vendor ID and device ID is recorded. Record the time a device was plugged in, when the device was stopped via software, and when the device was physically removed. Once operational logging is enabled, it’s important to generate data by plugging in different devices. This means there is no historical data to draw upon. Test Proceduresīy default, the Windows logging option for operations is disabled.

Enabling this feature will require administrative access to Windows. The current default in administrative policy is to have this feature disabled. Information on USB devices in Windows needs to be enabled before moving forward. Windows information on USB devices can be found here: Using Splunk, a security team can now monitor when these devices are plugged into systems. They can also be used to steal data, or move them into an unsecured location. They can help in moving data from one system to another. These devices are helpful in providing a backup location for important documents and files. As more security operation centers (SOC’s) look to limit sensitive data being exposed, USB removable storage devices (thumb drives, external hard drives, cell phones with high capacity storage, and SD cards) introduce risk. Splunk continues to be a valuable tool in providing insight into risk and threat detection. Information security is only as effective as physical security policies. Using Splunk to Monitor USB Removable Storage Devicesīy: Pete Chen | Splunk Practice Team Lead Windows Event Log Monitoring

Process monitor filter usb activity how to