Can Splunk monitor access to USB ports/drives?

[pchukwuma]

Can Splunk tell me when something is plugged into or removed from the USB port?

[Damine]

I have created this simple windows service to monitor and send log events to splunk indexer along with the files copied ,the ip address of the user and the username(json format) it will only send an event if the user copies something.
this is the link to the applications

http://www.codeproject.com/Tips/1109707/Log-USB-Events-to-Splunk-Or-Any-syslog-Server

[radialdrillingv]

Can this indexer capture information coming into USB in Microsoft UL protocol?

[pchukwuma]

Thank you NuS for your response.

[MuS]

Hi pchukwuma

since most OS's are able to somehow log when an USB device is plugged or unplugged, you can image that splunk> can eat up those logs. For Example on *nix you would find something in messages or could write a hot-plug event script to generate splunk> events. On Windows you would find the event in the event logs which splunk> is also able to read.

Based on that, you could setup alerts in splunk> and therefore the answer is: yes, splunk> can tell you when some USB device is plugged or unplugged.

cheers,
MuS