How to receive an email alert when there’s a file (WRITE) detected on a USB storage device by Elements Endpoint Protection Device Control? 

Issue:

How to receive an email alert when there's a file (WRITE) detected on a USB storage device by Elements Endpoint Protection Device Control? 

Resolution:

To receive an email alert when there's a file (WRITE) attempt detected on a USB storage device by Elements Endpoint Protection Device Control, you first need to enable detection of write attempts on a USB storage device:

1. Log in to the Elements Security Center portal
2. Navigate to the Security configurations > Profiles page
3. Click on the profile that is in use on the devices
4. Go to the Device control settings page
5. In the Removable mass storage devices section, enable Detect write attemps to USB storage devices
6.  Click Save profile

After you have enabled the alert in the profile, you will need to create a custom Security Event view which we can then use in an email report:

1. Navigate to the Events > Security Events page 
2. Click Clear all filters to remove existing filters
3. Create a new filter: Source – equals – Device control 
4. Open the View drop-down menu in the top-right corner 
5. Click Save as 
6. Click on the three dots on the right side of the view you created 
7. Select Copy to organization views 
8. Confirm action by clicking Copy to organization views 

By copying the view to organization views, it will be able to be selected as a data source when creating the email report.

Finally, create the email report:

1. Go to the Reports page
2. Open the Email notification and report tab
3. Click Add email report 
4. Add a name
5. As Data source, select Security Events 
6. As Template, select the device control view which you saved as an organization view
7. Set Schedule frequency as Continuous. Which means that emails are sent every 10 minutes
8. Enable Send only when report has content, which sends a new email only when there is new content on the Security Events page
9. Enter the recipients
10. Click Save