Security Compliance

USB devices do not detach with USB Defender (SEM)

Refer to this page if a SEM rule fired to alert you of a USB device attachment, but the USB device was not detached as it should have been.

First published date

10/18/2018 6:50 PM

Last published date

10/18/2018 6:50 PM

Overview

A Security Event Manager (formerly Log & Event Manager) rule fired to alert you of a USB device attachment, but the USB device was not detached as it should have been.

Product section

Security Event Manager

Cause

  • Your rule may not be configured with a Detach USB Device action.
  • No Windows Active Response connector is configured or running for that agent.

Resolution

Verify that the rule that sent the alert also tried to detach the device:

  1. On the SEM console menu bar, navigate to Explore > nDepth.
  2. Conduct a search for the following condition during the time frame of the email alert you received: InternalRuleFired.EventInfo=*USB*
  3. Find the rule fired event that should have detached the device and highlight it.
  4. From the Explore drop-down list on the top-right corner, and then choose Event.
  5. Verify that there is an InternalCommands event listed that has "Initiated Action: Detach USB Device" for the EventInfo.

Verify that there is a Windows Active Response connector configured for the affected agent:

SEM HTML5 console

  1. In the SEM Events Console, click the Nodes tab.
  2. Select the agent node, and then click Manage node connectors.
  3. Under Configured connectors, locate the Windows Active Response connector, and then make sure it is an active connector with a green icon. If it doesn't have a green icon, select it, and then click Start.
  4. If it is not under Configured connectors, enter Windows Active Response in the search box, and then configure the connector.

SEM Flash console

  1. On the SEM console menu bar, navigate to Manage > Nodes.
  2. Locate the agent in question, click its gear icon, and then select Connectors.
  3. Search for the Windows Active Response connector, and then make sure you have an active connector with a green icon. If you do not, click on the gear next to it and create a new one.

Verify the Detach Unauthorized USB Device rule has the correct settings. It should appear as below:
SEM HTML5 console


SEM Flash console