Security Compliance

Prevent a user from stopping the USB Defender service in SEM

Users in your environment have administrator access and are able to disable their SolarWinds Security Event Manager USB Defender service so they can attach their USB devices. It is possible for you to remove certain permissions from the service to prevent them from adjusting it, that falls far into Windows territory, so we'll be covering alternative responses you can configure on your SEM.

First published date

10/17/2018 2:28 PM

Last published date

10/17/2018 2:28 PM

Overview

Users in your environment have administrator access and are able to disable their SolarWinds Security Event Manager (formerly Log & Event Manager) USB Defender service so they can attach their USB devices.

It is possible for you to remove certain permissions from the service to prevent them from adjusting it, that falls far into Windows territory, so we'll be covering alternative responses you can configure on your SEM.

Product section

Security Event Manager

Resolution

Using ServiceStop events, we can easily clone a rule template to monitor for USB Defender stoppage and perform actions such as automatically restart the service or send an email alert to you.

  1. Go to Build > Rules and search for USB.
  2. Locate the USB-Defender Service Stopped template in the bottom section, click the gear icon, and clone it.
  3. Choose a user to receive the email alert from the Users drop-down list.
  4. If you want to automatically restart the service, drag the Start Windows Service action from the Actions section on the left to below the Send Email Message action on the right.
  5. Populate the Agent and Service Name boxes in that section for this to function.
    1. Expand the Events section in the top left corner and locate the ServiceStop event.
    2. Drag the InsertionIP field from the Fields section on the left to the Agent box on the right.
    3. Drag the ServiceName field from the Fields section on the left to the Service Name box on the right.
    4. Save and then Activate the rule.

In the HTML5 SEM Events Console (SEM 6.7 and later):

  1. In the SEM Events Console, click the Rules tab.
  2. On the Rules toolbar, click Create rule from template.
  3. In the search box, enter USB.
  4. Select the USB-Defender Service Stopped rule template, click Next, and then click Next again.
  5. Under Actions, click Add new action.
  6. in the search box, type email.
  7. Select Send Email Message, and then click Next.
  8. Select a recipient, and then click Add.
  9. If you want to automatically restart the service, click Add new action again, type start in the search box, select Start Windows Service, and then click Next.
  10. From the Agent drop-down list, select ServiceStop.InsertionIP.
  11. From the Service Name drop-down list, select ServiceStop.ServiceName, and then click Add.
  12. Review and adjust the rule details where needed, and then click Create.