USB device audit

[bowie]

is there any way to create an extension attribute that will contain audit of usb devices (storage) connected e.g. in the last month?

[PhillyPhoto]

You'd have to create a launch daemon that runs maybe once an hour and then writes the results to a file which the EA would read. The only issue is having a pretty complicated script that can read a CSV or other similar "database" where you can log what storage peripheral was seen and when and parse it down to something not overwhelming in Jamf then drop them if they haven't been seen in a month (i.e. "Peripheral", "First Seen", "Last Seen", any other info you need).

[mm2270]

Something like this is better left to a dedicated piece of software, like a DLP product. While it can be done using a method like what @PhillyPhoto mentioned, as was also stated, this could get very complex, very quickly. The methods of extracting attached USB drives in a script aren't very good. You have things like system_profiler SPStorageDataType or system_profiler SPUSBDataType or just things like diskutil, but none of those may give you what you're looking for. A LaunchAgent could use the StartOnMount key to only trigger when something gets mounted, (check this thread for info: https://community.jamf.com/t5/jamf-pro/launchd-startonmount-doesn-t-behave-as-expected/m-p/82262) but you would still need to create a complex script to extract out only attached removable storage, record all the relevant data and export it out to a file/plist. And getting it to only retain attached devices in the last 30 days might be difficult.

I understand why some organizations want Jamf Pro to be able to do everything to save on costs, but it's not a reasonable expectation. Jamf Pro is a device management tool, not a full blown DLP or security posture checking product. There are other things out there, including Jamf Protect that would better serve you on this, and can do a lot more than just that to bargain.

[AJPinto]

To second what others have said, this is really outside the wheelhouse of JAMF Pro and what CLI can do. Even using System Profiler you are assuming macOS is even aware of removable drives that are not currently connected. Even scripting System Profiler to run on check in or with an EA, would only reliably capture devices that are connected at the time System Profiler is ran.

This is really where a tool like Forcepoint, or to a lesser extent JAMF Protect which does have DLP controls and telemetry logging could come in.