Map external devices (1)

Action "PnpDeviceConnected" reports the connection of any plug and play device. Read more online on event 6416: https://docs.microsoft.com/windows/security/threat-protection/auditing/event-6416. Query #1: look for rare one-time devices connected to a specific machine.