Device Control: How to View and Manage Alerts

Issue

How are end users notified if a USB is blocked?

Environment

VMware Carbon Black Cloud Endpoint Standard

Resolution

In the event of a USB device block, both end users and console users alike will be Alerted on Block. If the organization has Sensor UI notifications enabled, the end user will receive a notification that access was blocked on their USB mass storage device. The end user notification includes the USB device’s serial number, which can be used to correlate devices in the console.

Additionally, administrators will receive notifications of USB device blocks in their environment and can easily approve devices directly from the alert by clicking “Approve”. You will also receive email notifications when USB device blocks occur if your organization has email notifications configured for Policy Actions or Alert Severity Threshold of 3 or higher.

To view only USB Device Control alerts in the console, use the “USB Device Control” alert type in the “Filters” section of the Alerts page.

Original source: https://community.carbonblack.com/t5/Endpoint-Standard-Documents/Device-Control-How-To-View-and-Manage-Alerts/ta-p/97486