Anyone know how to setup file monitoring of files copied to a USB removable device using full host DLP 9.1?
1. Log the name of the file being copied
2. Potentially copy the file into the evidence folder.
This can be achieved using a Removable Storage Protection Rule with actions ' Monitor and Store Evidence' . This will show you the file name and the Evidence in the Monitor.