Device activity
Device activity is Outpost’s record of the changes that happen on an endpoint without anyone running a script: a USB stick plugged in, a driver installed, a network share connected, a service disabled. Every change is written to the audit log, so you can answer “who connected what, and when”. Profile settings decide which changes also raise an alert, so someone is told at the time.
It is on by default for every endpoint, on every plan.
What is recorded
Section titled “What is recorded”| Change | Events | Alert category |
|---|---|---|
| USB devices | A USB device attached or removed. Mass storage is told apart from everything else. | device |
| Drivers | A driver installed, removed, or moved to another version. | device |
| Network drives | A network drive mapped or unmapped in a signed-in user’s session. | network |
| Shares with no drive letter | A connection to a share opened by typing its path, such as \\server\share, opened or closed. | network |
| Windows services | A service installed or removed, or its start type changed. Starting and stopping is not part of this; that is the stopped service alert. | service |
| Key system settings | A change to the endpoint’s security posture, autoruns, scheduled tasks, or local accounts. | device |
Changes to key system settings are recorded in the audit log only and never raise an alert from here. Security posture already has its own alerts, such as a firewall or antivirus turning off.
Where to see it
Section titled “Where to see it”- The audit log. Every event is recorded under Settings > Audit logs > Console actions, whether or not it raised an alert. See Audit logs.
- Alerts. Events that a profile says to alert on appear in the alert queue and on the endpoint’s Alerts tab. See Alerts.
- USB device history. The endpoint’s Hardware > Peripherals tab lists every USB device recorded for it, with its Kind, Serial number, First connected, Last connected, and Last removed.
Which events raise alerts
Section titled “Which events raise alerts”Recording is unconditional. Alerting is decided by Outpost from the endpoint’s profiles each time an event arrives, so turning an alert on takes effect at once, without waiting for the endpoint to pick up a policy change.
For the first 2 hours after an endpoint enrolls, info-severity events are recorded in the audit log but raise no alert, so the first inventory of a new endpoint does not flood the alert queue.
| Setting | Default | Alerts on |
|---|---|---|
device_activity.alert_on_usb_storage | On | A USB mass storage device attached or removed. |
device_activity.alert_on_usb_other | Off | Every other USB device, such as keyboards, mice, headsets, phones, and docks. Off by default because docks and peripherals reconnect all day. |
device_activity.alert_on_driver_change | On | A driver installed, removed, or changed version. |
device_activity.alert_on_netdrive_change | Off | A network drive mapped or unmapped. |
device_activity.alert_on_unc_change | Off | A share with no drive letter connected or disconnected. |
device_activity.alert_on_service_change | On | A Windows service installed, removed, or changed start type. |
For each alert setting, on anywhere wins: a narrower profile can turn an alert on for a sensitive site, and can never turn it off again where a broader profile turned it on. Some compliance baselines require the USB storage, driver, and service alerts. See Compliance.
Severity
Section titled “Severity”| Event | Severity |
|---|---|
| USB mass storage attached | Warning |
| Any other USB event, driver event, network drive, or share | Info |
| Service installed | Info, or warning for a service on the monitored service list |
| Service removed, or its start type changed | Warning, or critical for a service on the monitored service list |
A monitored service moving off automatic start is critical because it is how a
security service is quietly switched off: a service that is not set to start
automatically is skipped by the stopped service check, so nothing else would
notice. This includes a technician changing it from the console; the audit log
shows who did it and why. The monitored service list is the
monitoring.service_watchlist setting.
The same device plugged in again while its alert is open updates that alert instead of opening a second one. These alerts are never cleared automatically, because a device going away is not a recovery. They age out instead.
Turning it off
Section titled “Turning it off”device_activity.enabled is the master switch, on by default. Off stops
collection entirely, so both the audit entries and the alerts stop. Off
anywhere wins: a narrower profile cannot turn collection back on where a
broader one turned it off.
device_activity.user_session_poll_seconds, 120 by default, sets how often the
Windows tray app checks the signed-in user’s network connections. The tray
reports a device being plugged in or out without waiting for this interval. The shortest value wins, and 0
means the tray’s own default rather than never checking.
How it works
Section titled “How it works”The agent compares what it finds with what it found last time, about once an hour, and on Windows at once when the tray reports that a device was plugged in or out. The comparison is kept on the endpoint, so restarting or updating the agent does not report everything again as new.
The agent runs as a system service and cannot see a network drive or share connection that lives only inside a signed-in user’s session. On Windows, the Outpost tray app reports those from inside the session. For users who are not signed in, the agent reads saved drive mappings itself.
An endpoint that is offline when a USB device is plugged in does not send that event later, but the device still appears in its next inventory with the time it arrived.
Differences by operating system
Section titled “Differences by operating system”Device activity is collected from the same inventory as the endpoint’s Hardware and Software tabs, so it covers what each platform inventories.
- Windows reports every change listed on this page.
- Linux does not report driver changes, because the agent does not inventory drivers on Linux. Network drives are the network file systems mounted on the endpoint.
- macOS (Preview) reports what its inventory covers.
- Connections that exist only inside a user’s session, including shares with no drive letter, are reported from the Windows tray app only.
- FreeBSD and OpenBSD endpoints do not report device activity.
Related
Section titled “Related”Content is licensed CC BY 4.0. Code samples are MIT. Outpost and the Outpost mark are trademarks of Outpost Business Solutions, PBC and are not covered by either license.