Skip to main content
Tier One
Medium

USB mass storage device blocked on the OT gateway

A-1069

00:00time on this alert, target 20 minutes

Back to queue

Alert details

Source
DLP
Detection rule
DLP-USB-OT-004
Affected user
m.okafor
Affected host
PLC-GW-01
Source IP
—
First seen
2026-07-24T18:15:00Z

Why this fired, in plain English

A USB drive was plugged into a plant-floor computer, where removable storage is not allowed.

Suggested playbook

Data exfiltration to external storage

  1. 1. Determine whether the destination account is corporate or personal.
  2. 2. Compare volume against the host's own baseline, not an absolute number.
  3. 3. Identify the process: a backup agent and a browser upload mean very different things.
  4. 4. Check the classification and how many files were involved.
Open the full checklist

Raw log evidence

Exactly what the tools recorded — 3 events.

  1. Guided hint: this line matters

    ts=2026-07-24T18:14:02Z host=PLC-GW-01 src="dlp" event=usb_insert device_id="USB\\VID_0951&PID_1666" serial="60A44C4139" user="m.okafor" action=blocked_read_write

    The device was blocked before any files could be read or written.

  2. Guided hint: this line matters

    ts=2026-07-24T18:14:03Z src="asset_db" event=lookup serial="60A44C4139" registered=false owner=null

    The USB stick is not on the register of approved devices.

  3. Guided hint: this line matters

    ts=2026-07-24T18:14:40Z src="itsm" event=ticket_open ticket="INC-9930" summary="PLC firmware update media" requester="m.okafor" approval_state="pending"

    There is a ticket, but it has not been approved yet.

Related events

The order things happened in.

  1. 18:14Z

    Unregistered USB inserted and blocked

  2. 18:14Z

    Pending ticket opened for firmware media

Enrichment lookups

Mock lookups. Run each one yourself — a real analyst never guesses what a lookup would have said. There is no "run everything" button on purpose.

0 of 3 lookups checked

  • Not checked yet.

  • Not checked yet.

  • Not checked yet.

techniques

Your verdict

Keyboard shortcuts 1–4, or click. You can always change your mind afterwards.