Level Verified

macOS Monitor - USB Drive Script

Detects attached USB drives on macOS by scanning system profiles. Alerts you when a USB device is present, enabling quick responses to potential security risks.

Import into Level

Problem overview

Unregulated or unauthorized USB devices can expose macOS systems to data leaks, malware threats, and policy violations. Manually monitoring for USB connections is time-consuming and prone to oversight, leaving IT Professionals and MSPs vulnerable to unexpected security breaches.

Bash 100s timeout Runs as Local system macOS 
#!/bin/bash

# This resource is provided as a convenience for Level users. We cannot 
# guarantee it will work in all environments. Please test before deploying 
# to your production environment. We welcome contributions to our community 
# library

# Level Library
# https://level.io/library/script-macos-monitor-usb-drive

# Look for USB Drives
USB_DRIVE_PRESENT=$(system_profiler SPUSBDataType | grep "Mount Point")

if [[ ! -z "$USB_DRIVE_PRESENT" ]]; then
    # If USB drive is present, send console message for Level to alert on
    echo "ALERT"
fi

This script uses the built-in system_profiler command to detect any mounted USB drives on a macOS endpoint. If it finds an active USB device, it prints “ALERT,” which can be captured and reported by Level. This enables immediate visibility into unauthorized or unexpected removable media usage.

You can configure a script-based monitor in Level to trigger on-demand checks whenever USB-related activity is suspected, or set it to run on a schedule via a Level Automation. By pairing it with a remediation action, you can automatically disable or eject suspicious drives to maintain tighter security.

Use cases

  • Monitoring high-security environments for unauthorized removable devices
  • Detecting unexpected USB usage in remote work setups
  • Enforcing data protection rules where external drives are restricted
  • Auditing USB device activity on shared or public systems

Recommendations

  • Test the script in a non-production environment to confirm expected output
  • Use a script-based monitor in Level to generate immediate alerts on detection
  • Schedule periodic checks with Level Automations for continuous oversight
  • Consider pairing with a remediation script to disable or eject drives automatically
  • Keep detailed logs of alerts to identify patterns or repeated policy violations

Frequently asked questions.

How do I configure this script in Level?

Import it into Level and set up a script-based monitor or an Automation schedule, depending on your preferred usage.

Does the script block or eject USB drives?

No. It only detects them. Pair it with a separate remediation script if automatic removal is required.

Which macOS versions are compatible?

Most modern macOS versions that include system_profiler should work. Testing is advised to ensure compatibility.

Why is an alert triggered only if a USB drive is mounted?

Mounted drives present an immediate data access or transfer risk, which is why the script flags them.

Can I modify the alert message?

Yes. Update the echo statement within the script to suit your organization’s logging or notification needs.

Ready when you are.

No credit card. No sales call. Just sign up and start managing.

Start for free Talk to us