USB & Removable Storage Activity Logs

Viewing USB plug-in events, drive serial numbers, and file copy logs.

Sentinel Operations Team

4 min read

Updated August 28, 2026

v3.2

Every time a USB storage device is plugged in, Sentinel records the manufacturer name, product ID, serial number, drive letter, and timestamp. If a file is copied to the drive, the file name and size are logged.

Security Alert Triage — Suspicious USB Insertion & File Export

Critical Alert

Managed Endpoints

412 Online / 428 Total

Sync: 12s ago

Status	Hostname	Logged-In User	OS Build	Agent
Active	LAPTOP-FIN-019	corp\m.vasquez	Win 11 (23H2)	v3.2.4
Active	WS-ENG-8821	corp\d.kim	Ubuntu 22.04	v3.2.4
High CPU	MACBOOK-MKT-04	corp\a.wright	macOS 14.5	v3.2.0 (Update)

Pin #1:Incident Timeline

Microsecond-accurate event timeline correlating USB insertion, file reads, and clipboard activity.

Pin #2:1-Click Remediation

Isolate endpoint from network or terminate unauthorized processes immediately from this pane.

1Incident Timeline

21-Click Remediation

Figure 4.1: Security alert investigation modal detailing unauthorized USB mass storage connection and file export attempt.

Tags:#USB Logs#Removable Media#Hardware Audit

Was this documentation page helpful?

Your technician feedback helps our team continuously improve Sentinel guides.

Browser Telemetry & Web Activity Auditing

Security Alerts & Incident Triaging