| Event Id | 3240 |
| Source | EventTracker |
| Description | USB Monitoring stopped for H: <Drive Letter>\ Volume Label: <Volume Label> Volume Serial No: <Serial no> Volume ID: \\?\Volume{184f2451-1918-11de-900e-0013d38afad4}\ Type: Removable File System: FAT32 Network Volume: No Description: Change affects physical device or drive. Console User: <Console Username> Active Users: <Active username> Added <File Name> <Date Time> Added <File Name> <Date Time> Added <File Name> <Date Time> Modified <File Name> <Date Time> Added <File Name> <Date Time> |
| Event Information | Cause: This Event is Logged by EventTracker Agent when USB is ejected and monitoring is stopped. Resolution : This is an information event. Event description contains User name, File operations like file addition, deletion and modification performed on USB storage device. Verify any unauthorized file operation by any unauthorized user is performed on to USB device. |
| Reference Links |
Catch threats immediately
We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.