Can the DLP Endpoint Agent detect files copied from USB?

Products

• Data Loss Prevention Endpoint Prevent

Issue/Introduction

You want to monitor files copied from a USB for sensitive data that might have been copied from an external company's machine.

Resolution

Endpoint Prevent does not have a setting to monitor ONLY items copied from a USB drive. Endpoint Prevent was not design to monitor incoming sensitive information as the Endpoint Agent monitors USB Removable Storage devices as a destination channel not as a receiving channel as you can see in the Agent Configuration.

However in saying that if you enable the Local drive monitoring as a destination channel you should be able to detect sensitive information for example in a word document that is copied from the USB to the local C:\ drive but this would also monitor ALL activity on the local drive, not just items copied from the USB.