Currently running DLP 9.2, was curious if there is a way or setting to configure that would log when and what files were written to a CD\DVD by an approved user?
I don't believe so, because files are not "written" to CDs - they are read by applictions which then stream a bit image to the device.
It's very different from classic file read/write operations.
I'll look into it more, or maybe one of the DLP experts will contribute.
If the CD/DVD device was formatted using the newer Live File System and the OS sees the device as a Removable Media, the Removable Storage Protection (RSP) rule will trigger on files being written to CD/DVD devices.
If the old Mastered File System was chosen, then the (RSP) rule cannot be used. For this scenario, you would use the Application File Access Protection (AFAP) rule instead. This rule may be used to monitor applications like Nero, Roxio etc. to trigger on files access.
Why would the user use applications like Nero/Roxio if the intent is not to burn CD/DVDs.
The AFAP rule support content only in a later 9.2 version. You would want to move to the 9.2 version that supports this feature or 9.3.