{"id":7939,"date":"2026-10-13T12:20:22","date_gmt":"2026-10-13T09:20:22","guid":{"rendered":"https:\/\/support.withsecure.com\/?post_type=support_article&p=7939"},"modified":"2026-10-13T12:20:22","modified_gmt":"2026-10-13T09:20:22","slug":"how-to-receive-an-email-alert-when-theres-a-file-write-detected-on-a-usb-storage-device-by-elements-endpoint-protection-device-control","status":"publish","type":"support_article","link":"https:\/\/support.withsecure.com\/en\/support-articles\/how-to-receive-an-email-alert-when-theres-a-file-write-detected-on-a-usb-storage-device-by-elements-endpoint-protection-device-control\/","title":{"rendered":"How to receive an email alert when there’s a file (WRITE) detected on a USB storage device by Elements Endpoint Protection Device Control?\u00a0"},"content":{"rendered":"

Issue:<\/h3>\n

How to receive an email alert when there's a file (WRITE) detected on a USB storage device by Elements Endpoint Protection Device Control?\u00a0<\/p>\n

Resolution:<\/h3>\n

To receive an email alert when there's a file (WRITE) attempt detected on a USB storage device by Elements Endpoint Protection Device Control, you first need to enable detection of write attempts on a USB storage device:<\/p>\n

    \n
  1. Log in to the Elements Security Center portal<\/li>\n
  2. Navigate to the Security configurations > Profiles <\/strong>page<\/li>\n
  3. Click on the profile that is in use on the devices<\/li>\n
  4. Go to the Device control <\/strong>settings page<\/li>\n
  5. In the Removable mass storage devices <\/strong>section, enable Detect write attemps to USB storage devices<\/strong><\/li>\n
  6. \u00a0Click Save profile<\/strong><\/li>\n<\/ol>\n

    After you have enabled the alert in the profile, you will need to create a custom Security Event view which we can then use in an email report:<\/p>\n

      \n
    1. Navigate to the Events > Security Events <\/strong>page\u00a0<\/li>\n
    2. Click Clear all filters <\/strong>to remove existing filters<\/li>\n
    3. Create a new filter: Source – equals – Device control\u00a0<\/strong><\/li>\n
    4. Open the View <\/strong>drop-down menu in the top-right corner\u00a0<\/li>\n
    5. Click Save as\u00a0<\/strong><\/li>\n
    6. Click on the three dots <\/strong>on the right side of the view you created\u00a0<\/li>\n
    7. Select Copy to organization views\u00a0<\/strong><\/li>\n
    8. Confirm action by clicking Copy to organization views\u00a0<\/strong><\/li>\n<\/ol>\n

      By copying the view to organization views, it will be able to be selected as a data source when creating the email report.<\/p>\n

      Finally, create the email report:<\/p>\n

        \n
      1. Go to the Reports <\/strong>page<\/li>\n
      2. Open the Email notification and report <\/strong>tab<\/li>\n
      3. Click Add email report\u00a0<\/strong><\/li>\n
      4. Add a name<\/li>\n
      5. As Data source<\/strong>, select Security Events\u00a0<\/strong><\/li>\n
      6. As Template, select the device control view which you saved as an organization view<\/li>\n
      7. Set Schedule frequency <\/strong>as Continuous<\/strong>. Which means that emails are sent every 10 minutes<\/li>\n
      8. Enable Send only when report has content<\/strong>, which sends a new email only when there is new content on the Security Events page<\/li>\n
      9. Enter the recipients<\/li>\n
      10. Click Save<\/strong><\/li>\n<\/ol>\n","protected":false},"excerpt":{"rendered":"

        How to receive an email alert when there’s a file (WRITE) detected on a USB storage device by Elements Endpoint Protection Device Control?\u00a0<\/p>\n","protected":false},"template":"","support_article_product":[99],"class_list":["post-7939","support_article","type-support_article","status-publish","hentry"],"acf":{"source_foreign_id":"000005262","source_version":1,"source_system":"salesforce","source_date_updated":"2026-10-13 09:20:22","import_hash":"29e42a442e632a1ac146ef157c714db4ccef9b9a","vanilla_article_id":"","vanilla_url":"","vanilla_kb_id":"","vanilla_category_id":"","machine_translated":false,"reactions_helpful_yes":"","reactions_helpful_no":""},"_links":{"self":[{"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/support_article\/7939","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/support_article"}],"about":[{"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/types\/support_article"}],"wp:attachment":[{"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/media?parent=7939"}],"wp:term":[{"taxonomy":"support_article_product","embeddable":true,"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/support_article_product?post=7939"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}