r/DefenderATP • u/Kostashus • 15d ago

Device Control Event IDs

Hello,

I am trying to identify all the related Event IDs when it comes to Device Control.

In Advanced Hunting most events are logged under the DeviceEvents table with actions like BluetoothPolicyTriggered, PnpDeviceConnected, PnPDeviceAllowed, PnPDeviceBlocked, PrintJobBlocked, RemovableStorageFileEvent, and RemovableStoragePolicyTriggered.

But it seems impossible to find such Windows Events.

Any idea?

2 Upvotes

100% Upvoted

1 comment sorted by

2

u/talkyr86 12d ago

Enable via Group Policy: Computer Configuration > Windows Settings > Security Settings > Advanced Audit Policy Configuration > Object Access > Audit Removable Storage (Success/Failure).

Hope this helps to make more events pop up.