[IC] - Detect PnP Devices Connected To My Endpoint Machines
This query look for PnP devices connected or allowed into Endpoint machines. Basically, you can use the action types "PnpDeviceConnected" / "PnpDeviceConnected" to have a list of PnP devices connected to your endpoints and it helps with some concerns such as: 1. Keeping an eye out for PnP devices like USB drives or external disks being connected to critical servers (like DC's, Exchange servers, or any machine with sensitive info). 2. If I’m handling sensitive info that shouldn’t be shared or printed, I want to make sure no printers are connected to my endpoints 3. Spotting unfamiliar devices from unknown vendors 4. Finding PnP devices that might be out of date and need attention
Microsoft Sentinel (KQL)
