If an end user attempts to access a blocked USB storage device, the system triggers a deny policy action, resulting in an alert. You view device control alerts on the Alerts page.

Procedure

  1. On the left navigation pane, click Alerts.
  2. To filter results on device alerts, select the USB Device Control from the Type filter.
  3. Double-click an alert or click the > to the right of the Actions column to view the expanded right-side panel.
    In this panel, view device details like vendor ID, product ID, and serial number.
  4. To approve the blocked USB device, click Approve.
  5. Optional. Go to the Inventory > USB Devices page to view all devices detected in your environment.
    1. To download a CSV file with all or filtered attached external devices, and the associated data, select Export from the USB Devices tab.
      The file name follows the USBDevices-<Date-of-export>-<OrgKey> format. If a USB device mounts to multiple endpoints, each combination of the device with an endpoint appears in a separate row along with First seen and Last seen timestamps for the endpoint.
    2. To download a CSV file with all or filtered approved external devices, and the associated data, select Export from the Approvals tab.
      The file name follows the USBApprovals-<Date-of-export>-<OrgKey> format.