Submit a ticketCall us

Don’t fall victim to a ransomware attack
Backups are helpful, but sometimes that’s not enough to protect your business against ransomware. At our live webcast we will discuss how to protect against ransomware attacks with SolarWinds® Patch Manager and how to leverage log data to detect ransomware. Register now for our live webcast.

Home > Success Center > Log & Event Manager (LEM) > Create a USB rule to fire when someone writes to it

Create a USB rule to fire when someone writes to it

Table of contents
Created by David Clark, last modified by MindTouch on Jun 23, 2016

Views: 13 Votes: 0 Revisions: 3

Overview

This article provides steps on how to create a USB rule to fire when someone writes to it. 

Environment

All versions of LEM​

Steps

  1. Go to Build > Rules > click on the (+) on the top right corner.
  2. Click Events on the left side of the screen. 
  3. Type in FileWrite In the search box.
  4. In the Fields box under FileWrite, click on EventInfo and drag it over to the Correlations box.
  5. After the (=) and the *, type USB*  It should look like this: *USB*
  6. Select the answer you prefer. 

 

Last modified
19:57, 22 Jun 2016

Tags

Classifications

Public