cancel
Showing results for 
Search instead for 
Did you mean: 

DLP Logs

Is there a log that will tell you and alert you if someone plugs in a usb flash drive

5 Replies
JoeyMc
Level 10
Report Inappropriate Content
Message 2 of 6

Re: DLP Logs

Yes. You can create a removable storage protection rule and set it to monitor. Then create an automated response in ePO to email an alert.

Re: DLP Logs

I don't see a DLP automatic response in automatic responses, tried to add new response no go.....how did you do it?

Thanks,

mark

JoeyMc
Level 10
Report Inappropriate Content
Message 4 of 6

Re: DLP Logs

The event group is ePO Notification Events

Event type: Threat

The Filter I have is:

Detecting Product Name Equals: Data Loss Prevention

Event Description Equals: Email Protection ( you would change this to Removable Storage Protection)

Threat action equals: BL|EVDNC|MON|NTFY|ON (You would change this to match your rule, or you could leave this off) I use this to only see Email blocks.

Action: Send Email

Subject: McAfee DLP Email Event - User Blocked: {sourceHostName}/{sourceUserName}

Body:

User Name : {sourceUserName}

Host Name: {sourceHostName}

Event UTC : {detectedUTC}

IP address: {sourceIPV4}

Event Type : {eventDesc}

Action Taken: {threatActionTaken}

Threat Category: {threatCategory}

Threat Name: {threatName}

Threat Severity: {threatSeverity}

Threat Type: {threatType}

Highlighted
JoeyMc
Level 10
Report Inappropriate Content
Message 5 of 6

Re: DLP Logs

Also as far as a "log": Use the DLP Monitor plug-in, right? Set a filter to Removable Storage.

Re: DLP Logs

Thanks got that to wrk good thanks.........

Now my boss wants me to detect anything that is plugged into a USB port....Iphone, Drives, DVD, etc. want it very generic.....can this be done?

Mark

More McAfee Tools to Help You
  • Subscription Service Notification (SNS)
  • How-to: Endpoint Removal Tool
  • Support: Endpoint Security
  • eSupport: Policy Orchestrator
  • Community Help Hub

      New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

    • Find Forum FAQs
    • Learn How to Earn Badges
    • Ask for Help
    Go to Community Help

    Join the Community

      Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

    • Get helpful solutions from McAfee experts.
    • Stay connected to product conversations that matter to you.
    • Participate in product groups led by McAfee employees.
    Join the Community
    Join the Community