Level Verified

Linux Monitor - USB Drive Script

Detects the presence of USB drives on a Linux system. Triggers an alert if any are found, helping MSPs and IT Pros proactively manage data security risks.

Import into Level

Problem overview

Unauthorized or unaccounted-for USB drives can pose significant security threats, from data theft to malware injection. Monitoring for USB drive insertions is essential for organizations that want to safeguard their systems and maintain compliance with data protection policies.

Bash 100s timeout Runs as Local system Linux 
#!/bin/bash

# This resource is provided as a convenience for Level users. We cannot 
# guarantee it will work in all environments. Please test before deploying 
# to your production environment. We welcome contributions to our community 
# library

# Level Library
# https://level.io/library/script-linux-monitor-usb-drive

# Look for USB Drives
USBDrivePresent=$(lsblk -o NAME,TRAN | grep "usb" | awk '{print $1}')

if [ -n "$USBDrivePresent" ]; then
    # If USB drive is present, send console message for Level to alert on
    echo "ALERT"
fi

This script quickly checks whether any USB storage devices are currently connected to the system. If it detects a USB drive, it returns a simple "ALERT" message, which you can capture with a script-based monitor in Level to trigger a real-time notification and log the event.

You can also build an Automation in Level with a schedule trigger to regularly check for USB drives and act on any findings—this can include disabling the port or generating a security ticket for further investigation.

Use cases

  • Monitoring secure environments for unauthorized USB attachments
  • Enforcing data protection policies in regulated industries
  • Logging removable media usage on remote or distributed workstations
  • Real-time alerting of potential data exfiltration attempts

Recommendations

  • Test the script in a safe environment before deploying widely
  • Use a script-based monitor in Level to instantly detect drive insertions
  • Consider scheduling automated checks via Level’s Automation features
  • Verify that lsblk is available and functioning correctly on your Linux distribution
  • Plan immediate or follow-up actions for any alerts—lockdown, logging, or user notifications

Frequently asked questions.

How do I integrate this script with Level?

Import the script as a resource in Level, then configure a script-based monitor or scheduled Automation to run it.

Does this script prevent USB use?

No. It merely detects USB devices and triggers an alert; restricting usage requires additional configurations.

What permissions are needed?

It runs with System or Root privileges under Level, so it can accurately detect connected drives.

Will it detect other removable media types?

This script specifically checks for USB transport. You may need to modify it to detect other device types.

Are there any performance impacts?

The script is lightweight and does a quick check, so there should be minimal performance overhead even if run frequently.

Ready when you are.

No credit card. No sales call. Just sign up and start managing.

Start for free Talk to us