Not sure if there is a tool out there but I basically would like to find a piece of software or multiple pieces of software that I could install on all my hosts within a network, for example my office network and if someone plugs a USB stick into a machine or they downloaded / uploaded a piece of code I could be noticed of such events.

Is there something out there which could do at least one of these things or would it be more of a bespoke solution I would need to build

Any advice would be great.

  • you want to be notified about the plugging in of USB, or the writing/reading of the USB?
    – schroeder
    Feb 26, 2015 at 23:31
  • some anti-malware software can monitor USB activity - I know SEP does.
    – schroeder
    Feb 26, 2015 at 23:32
  • Cameron - these types of questions are off topic here. I'll see whether software recs want it
    – Rory Alsop
    Feb 27, 2015 at 8:46
  • This question is on-topic on Software Recommendations, but it could be improved. OS? Price? Footprint? Only USB insertion and downloads? Please read meta.softwarerecs.stackexchange.com/questions/336/… and edit your question
    – user416
    Feb 27, 2015 at 9:20

2 Answers 2


Host based intrusion detection system should address your requirements. Can be agent-based or agentless (remote agent), in all cases you'd need to write appropriate policy to cover your requirements. Example of monitored events: file checksums, log events, network connections,processes running in memory etc.

Example of host based IDS software: OSSEC (please note: example based on availability of this free and open source software for evaluation, it is not recommendation to use it in production environment to achieve your goals). http://www.ossec.net


McAfee ePO (a.k.a McAfee Virus Scan) has a add-on component that can be administered through the centralized ePO console for end point configuration scanning as well as there is another component for DLP passive sensitive data scanning of systems.bit can block devices, auth specific devices, and allow transfer of only specific data.. Depending on scale it can be an expensive or very cost effective solution.

We had Symantec SEP and CSP as well but are in the process of removing them as they are HUGE resource on the system itself as well from what I understand the SEP component generated tons of excess network activity. Basically a hog and are a pain all around, some of it may have been the people... I just saw what it did to my production systems anytime they touched the config for it.

It is not 100% clear of the end goal or content your are wanting to protect, if you are looking for sensitive data searches there are a variety of specialized tools for the specific data.

I have personally used Card Recon and McAfee's agent and appliance based DLP for sensitive data search. Card Recon is really good for CHD with VERY low false positive rates on card data and can do other data types, but does miss some things. McAfee DLP requires some serious tuning to reduce false positives so the results are digestible.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.