Alert when USB Removable disk is connected to system.

Please refer the below script, It will give alert whenever the user plugged/connected USB removable disk to the system, it will give alert like "A new device is connected/detected by your system " , otherwise it will show “No new devices is connected/detected” and also it will displays the number of USB devices are connected/detected by the system.

Tested in OS: Windows 10, Windows 8, Windows 7.

CODE:

# The script is a template to check UAC status on device.
import os
import sys

def alert(arg):
    sys.stderr.write("%d%d%d" % (arg, arg, arg))

# Please use "alert(1)" to turn on the monitor(trigger an alert)
# Please use "alert(0)" to turn off the monitor(disable an alert)
# Please do not change above block and write your script below


def usb():
    import getpass
    print "USER NAME: "+getpass.getuser()
    import os
    import re
    import socket
    s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
    s.connect(("8.8.8.8", 80))
    print "IP-ADDRESS : "+(s.getsockname()[0])
    a=os.popen('wmic logicaldisk where drivetype=2 get deviceid, volumename, description,size').read()
    dev=re.findall('([A-Z]:\s+[0-9]+|[A-Z]:\s+)',a)
    list=[]
    for i in dev:
        list.append(i.split())

    length=len(list)
    if length==0:
        print "NO NEW DEVICES DETECTED"
        alert(0)

    k=0  
    c=0
    for m in range(0,length-1):
        k=k+1

        if(list[0][k]!=" "):
            c=c+1

        d=str(c)
        print d+ " , New USB REMOVABLE DEVICE(S) HAS BEEN DETECTED BY YOUR SYSTEM"
        alert(1)      

usb()

SAMPLE OUTPUT:

20170613-usbk.json (1.83 KB)

@kamalsai

windows 10
File “<string>”, line 42 d=str(c) ^ IndentationError: unexpected indent

hai @phcsolutions, Please refer above updated script and JSON file. "Alert when USB Removable disk is connected to the system and use this script as the CUSTOM MONITORING.

Please refer the wiki guide for how to use the custom monitoring scripts:
https://forum.mspconsortium.com/forum/products/other-comodo-products/comodo-device-management/wiki-faq-how-to/11486-how-to-use-custom-script-procedure-monitoring .