---
title: "Device activity"
description: "How Outpost records USB devices, driver changes, network drive and share connections, and service changes on endpoints, and which of them raise alerts."
url: "https://support.outpostplatform.com/endpoints/device-activity/"
product: "depot"
type: "concept"
status: "draft"
ai_summary: "Outpost device activity: endpoints report USB devices, driver changes, network drive and driveless share connections in the user's session, Windows service changes, and posture, autorun, task, and local account changes. Every event is audited; device_activity.* settings decide which raise alerts. Defaults, severities, per-OS notes."
availability:
  plans: ["home-lab", "essentials", "enterprise", "msp"]
  platforms: ["windows", "linux", "macos"]
  preview: false
source: "https://gitlab.com/outpostplatform/docs/-/edit/main/src/content/docs/endpoints/device-activity.md"
license: "CC BY 4.0"
---

# Device activity

Device activity is Outpost's record of the changes that happen on an endpoint
without anyone running a script: a USB stick plugged in, a driver installed, a
network share connected, a service disabled. Every change is written to the
audit log, so you can answer "who connected what, and when". Profile settings
decide which changes also raise an alert, so someone is told at the time.

It is on by default for every endpoint, on every plan.

## What is recorded

| Change | Events | Alert category |
| --- | --- | --- |
| USB devices | A USB device attached or removed. Mass storage is told apart from everything else. | device |
| Drivers | A driver installed, removed, or moved to another version. | device |
| Network drives | A network drive mapped or unmapped in a signed-in user's session. | network |
| Shares with no drive letter | A connection to a share opened by typing its path, such as `\\server\share`, opened or closed. | network |
| Windows services | A service installed or removed, or its start type changed. Starting and stopping is not part of this; that is the stopped service alert. | service |
| Key system settings | A change to the endpoint's security posture, autoruns, scheduled tasks, or local accounts. | device |

Changes to key system settings are recorded in the audit log only and never
raise an alert from here. Security posture already has its own alerts, such as
a firewall or antivirus turning off.

## Where to see it

- **The audit log.** Every event is recorded under **Settings** > **Audit
  logs** > **Console actions**, whether or not it raised an alert. See
  [Audit logs](/depot/audit-log/).
- **Alerts.** Events that a profile says to alert on appear in the alert queue
  and on the endpoint's **Alerts** tab. See [Alerts](/service-desk/alerts/).
- **USB device history.** The endpoint's **Hardware** > **Peripherals** tab
  lists every USB device recorded for it, with its **Kind**, **Serial
  number**, **First connected**, **Last connected**, and **Last removed**.

## Which events raise alerts

Recording is unconditional. Alerting is decided by Outpost from the endpoint's
profiles each time an event arrives, so turning an alert on takes effect at
once, without waiting for the endpoint to pick up a policy change.

For the first 2 hours after an endpoint enrolls, info-severity events are
recorded in the audit log but raise no alert, so the first inventory of a new
endpoint does not flood the alert queue.

| Setting | Default | Alerts on |
| --- | --- | --- |
| `device_activity.alert_on_usb_storage` | On | A USB mass storage device attached or removed. |
| `device_activity.alert_on_usb_other` | Off | Every other USB device, such as keyboards, mice, headsets, phones, and docks. Off by default because docks and peripherals reconnect all day. |
| `device_activity.alert_on_driver_change` | On | A driver installed, removed, or changed version. |
| `device_activity.alert_on_netdrive_change` | Off | A network drive mapped or unmapped. |
| `device_activity.alert_on_unc_change` | Off | A share with no drive letter connected or disconnected. |
| `device_activity.alert_on_service_change` | On | A Windows service installed, removed, or changed start type. |

For each alert setting, on anywhere wins: a narrower profile can turn an alert
on for a sensitive site, and can never turn it off again where a broader
profile turned it on. Some compliance baselines require the USB storage,
driver, and service alerts. See [Compliance](/compliance/).

### Severity

| Event | Severity |
| --- | --- |
| USB mass storage attached | Warning |
| Any other USB event, driver event, network drive, or share | Info |
| Service installed | Info, or warning for a service on the monitored service list |
| Service removed, or its start type changed | Warning, or critical for a service on the monitored service list |

A monitored service moving off automatic start is critical because it is how a
security service is quietly switched off: a service that is not set to start
automatically is skipped by the stopped service check, so nothing else would
notice. This includes a technician changing it from the console; the audit log
shows who did it and why. The monitored service list is the
`monitoring.service_watchlist` setting.

The same device plugged in again while its alert is open updates that alert
instead of opening a second one. These alerts are never cleared automatically,
because a device going away is not a recovery. They age out instead.

## Turning it off

`device_activity.enabled` is the master switch, on by default. Off stops
collection entirely, so both the audit entries and the alerts stop. Off
anywhere wins: a narrower profile cannot turn collection back on where a
broader one turned it off.

`device_activity.user_session_poll_seconds`, 120 by default, sets how often the
Windows tray app checks the signed-in user's network connections. The tray
reports a device being plugged in or out without waiting for this interval. The shortest value wins, and `0`
means the tray's own default rather than never checking.

## How it works

The agent compares what it finds with what it found last time, about once an
hour, and on Windows at once when the tray reports that a device was plugged in
or out. The
comparison is kept on the endpoint, so restarting or updating the agent does
not report everything again as new.

The agent runs as a system service and cannot see a network drive or share
connection that lives only inside a signed-in user's session. On Windows, the
[Outpost tray app](/tray/) reports those from inside the session. For users
who are not signed in, the agent reads saved drive mappings itself.

An endpoint that is offline when a USB device is plugged in does not send that
event later, but the device still appears in its next inventory with the time
it arrived.

## Differences by operating system

Device activity is collected from the same inventory as the endpoint's
**Hardware** and **Software** tabs, so it covers what each platform
inventories.

- **Windows** reports every change listed on this page.
- **Linux** does not report driver changes, because the agent does not
  inventory drivers on Linux. Network drives are the network file systems
  mounted on the endpoint.
- **macOS** (Preview) reports what its inventory covers.
- Connections that exist only inside a user's session, including shares with
  no drive letter, are reported from the Windows tray app only.
- FreeBSD and OpenBSD endpoints do not report device activity.

## Related

- [Audit logs](/depot/audit-log/)
- [Alerts](/service-desk/alerts/)
- [Endpoint details](/endpoints/endpoint-details/)
- [Profiles](/automation/profiles/)