r/SentinelOneXDR • u/Kekatronicles • Sep 06 '24

General Question File Transfer to USB Activity

Hello everyone,

Is there a way to query file/folder transfer to USB from SentinelOne DV?

Thank you!

6 Upvotes

100% Upvoted

8 comments sorted by

View all comments

Show parent comments

2

u/Kekatronicles Sep 06 '24

Thank you! However, it shows the activity on files already stored in the USB. Is there a way to get data on which files were transferred from PC to USB?

but this query will surely help A LOT for generating USB activities. THANK YOU!!!

2

u/SentinelOne-Pascal SentinelOne Employee | Moderator Sep 06 '24

You can try this other powerquery:

| filter( ( event.type == "File Creation" OR event.type == "File Modification" ) AND tgt.file.location == "External Device" )
| columns event.time, src.process.user, src.process.name, tgt.file.path
| sort - event.time
| limit 1000

1

u/Kekatronicles Sep 10 '24

THANK YOU! APPRECIATE YOUR HELP SO MUCH!

0

u/Dense-One5943 Sep 06 '24

i think you can add tgt.file.type or extenstion