Endpoint Protection

Hi,

We've set up a policy that logs the files written to USB drives. I want to ask if there is a way to know what type of "write" generated the event. For example if I copy a file to the USB drive, or if I delete from the drive.

Regards,

Raul

Please follow the steps mentioned here

https://www-secure.symantec.com/connect/forums/how-see-written-activity-usb-drive#comment-2798191

You need to add wild cards so that it can be logged

check ajeeth kumars solution on this , hope this helps

yes i had this issue & it was solved successfully.

Hi Rafeeq and ajeet kumar,

Thanks for the suggestions but it is not quite what I want, though I saw a field API in the logs that indicates the operation that was made(File Write, File Read, etc...). What I would like is to have some more detailed info abaout a write event(ex: File Write, File Delete...), but I think there is a limitation in the design of the database.

Regards,
Raul

So far this is the detailed list we get from... thanks to ajeet..

it would be good if you can , make a product enhancement request..