Records every USB event: descriptor read, role assignment (host/device), mount, and bytes transferred. Even disconnected devices remain logged with VID/PID and outcome.
9
Connections 7d
2
Data-capable
1
Blocked
Event log
OK31 Dec · 21:50· No data lines active
USB-C Charger · VID 0BDA PID 8156
Power-only negotiation (PD 3.0, 27W)
Outcome
Data interface electrically disabled. Charged 18% → 64%.
Warn30 Dec · 20:00· ext4 · 58 GB free
SanDisk Ultra 64GB · VID 0781 PID 5591
Mass storage mounted read-only
Outcome
Mounted RO by policy. User imported 3 files (4.2 MB) before unmounting.
Threat29 Dec · 15:48· BadUSB heuristics triggered
Unknown HID · VID 1A2C PID 0042
Claims keyboard descriptor
Outcome
Device blocked — descriptor mismatch with declared class. Never enumerated.
OK28 Dec · 11:00· Trusted host
MacBook Pro · MTP transfer
Media transfer protocol session
Outcome
User-approved. 412 MB exported (photos folder).
OK26 Dec · 17:30· 5V / 2.1A
USB-C Charger · in-car
Power-only
Outcome
Charged during commute. No data exchange.
Warn24 Dec · 02:00· Ethernet declined
Anker hub · VID 291A PID 8395
Composite (HID + Ethernet)
Outcome
Only HID class allowed. Ethernet sub-device refused to prevent network pivot.