Security Compliance

Allow a new USB device that is blocked by SEM

Learn more about page settings Have a USB device being blocked for unauthorized USB device rule or just how to add a new USB device to be allowed on your network

First published date

10/19/2018 10:18 PM

Last published date

10/19/2018 10:18 PM

Overview

This article applies to Security Event Manager (formerly Log & Event Manager).
A USB device is being blocked for unauthorized USB device rule. This article shows how to add a new USB device to be allowed on your network.

Product section

Security Event Manager

Resolution

  1. Go to Build > Rules > search for USB > find your name for your USB authorized USB Devices.
  2. Make note of the USB name, and then go to Build > Groups > search for USB > click on gear beside the Name of your authorized USB devices.
  3. You can add the new USB device if you know the Unique ID.
    If not, jump to step 4 > give it a name > the DATA is going to be the unique USB ID for that device and then you can give it a description. 
    Note: If you do not have the USB unique ID, it may have been blocked from the rules.
  4. On the SEM menu bar, navigate to Explore > nDepth.
    1. In the List pane, expand the Events group (orange triangle).
    2. In the Events search box, type InternalRuleFired.
    3. Click the InternalRuleFired event and drag it into the nDepth search box..
    4. Change time frame on the far right, and then locate the rule that blocked the USB device in the Result Details.