DLP audit logs

[Majidkhan]

Hi, Is it possible to obtain a record of files that have been read and written to removable storage? Is this a feature we can enable in McAfee?

[Mreaden]

Majidkhan Report,

You will need to create a Removable Storage Device rule (if one is not already in place) and set the Reaction to 'No Action' and check the 'Report Incident' option. 

Once the rule is applied to endpoints, the Incident Manager will show information about files that have been read or written to removable storage. 

Thanks