How to query combining content and storage details in device manager (DLP 9.3)
Is there a way to create a report with the destination details received via a Removable Storage Device Rule (Device Class Name, USB Serial Number, etc) event with the content details provided by a Removable Storage Protection Rule (File Name, Destination Folder, etc) event? For example, a storage protection event will tell me file.pdf went from the F:\xxx\xxx\file.pdf to K:\xxx\xxx\file.pdf, with no indication of where the K: resides. My storage device rule will give me all the device details within the context of it being plugged or unplugged. Both rules are in monitor mode.
I only have the device control license, not sure if this is limiting what I can do here.