Title
#eclecticiq-polylogyx-extension
o

OpenPlgx

12/01/2021, 3:52 PM
We will roll up a fix for that. And while we are at it, and given you are a sysmon user as well, we observed that sysmon doesn't give events for mounted drives. How useful would you say it is, if any.
l

lvferdi

12/02/2021, 4:05 PM
useful, especially in PCI environments or other regulated environments where the use of external media is heavily governed.
4:17 PM
and I answered about removable media not mounted drives. If osquery doesn't provide that natively it would be very useful.