How to get USB Device Control - Activity

[salugr]

Hello
I don't find out how to get the USB Device Control activities for a specific host at a specific date/time. Can someone help me to find the right powershell cmdlet? The result should include the Combined ID of the USB device. Thanks

[bk-cs]

Device Control activity logs are contained in the event telemetry which is not currently available via API.

[salugr]

Thank you for the fast answer

[harrim4n]

You can set up a scheduled search for the relevant event_simpleNames and fetch the relevant data that way - that's what I did. A bit more cumbersome and heavier on API usage, but it works.

[harrim4n]

Also, I couldn't find any event which directly contained the combined ID, but it's just a combination of multiple IDs which are contained in the USB connect event

[bk-cs]

Thanks for adding that suggestion! Sometimes I forget about scheduled searches... 😄