You can control access to USB storage devices by approving access to a USB Device.

  • This SOAR action can be run from an alert, and isrun on one alert at a time.
  • Upon success of the action, the status of the USB device is updated from UNAPPROVED to APPROVED in ServiceNow.
  • If the action is performed on an alert that is APPROVED, the Notes and Approval Name are updated in Carbon Black Cloud based on the provided input.