Security for Removable Media (secRMM) Library

Squadra.secRMM :: 1.0.7.0 (Management Pack)

secRMM is a security product from Squadra Technologies which monitors and controls all 'Removable Media' activities in your data centers. Removable Media in this context is any USB removable storage device, removable external hard drives, smart phones, etc. This Operations Manager Management Pack will collect the secRMM events and create Operations Manager alerts.

Summary

This management pack incorporates the secRMM product from Squadra Technologies into Microsoft Operations Manager. secRMM is a product that monitors and controls activity to Removable Media devices. secRMM uses the security event log as well as its own event log to record the Removable Media online, offline and write activity. secRMM also allows the ability to authorize access to Removable Media devices by user(s) and/or by program(s).

External

Squadra Technologies web site

Management Pack Elements

Classes (1)

 DisplayNameIDBase ClassAbstractHostedSingletonGroupExtensionAccessibility
Squadra.secRMM.EventsecRMMSquadra.secRMM.EventMicrosoft.Windows.LocalApplicationFalseTrueFalseFalseFalseInternal

Discoveries (1)

 DisplayNameIDTargetEnabled
Squadra.secRMM.Event.DiscoverysecRMMEvent DiscoverySquadra.secRMM.Event.DiscoveryMicrosoft.Windows.ComputerTrue

Rules (9)

 DisplayNameIDTargetCategoryEnabledAlert Generate
Squadra.secRMM.FileWrittensecRMM RMMDeviceFileWrittenSquadra.secRMM.FileWrittenSquadra.secRMM.EventAlertTrueTrue
Squadra.secRMM.InvalidLicensesecRMM RMMInvalidLicenseSquadra.secRMM.InvalidLicenseSquadra.secRMM.EventAlertTrueTrue
Squadra.secRMM.ProgramAuthorizationFailuresecRMM RMMProgramAuthorizationFailureSquadra.secRMM.ProgramAuthorizationFailureSquadra.secRMM.EventAlertTrueTrue
Squadra.secRMM.PropertyChangedsecRMM Property ChangedSquadra.secRMM.PropertyChangedSquadra.secRMM.EventAlertTrueTrue
Squadra.secRMM.RMMDeviceOfflinesecRMM RMMDeviceOfflineSquadra.secRMM.RMMDeviceOfflineSquadra.secRMM.EventAlertTrueTrue
Squadra.secRMM.RMMDeviceOnlinesecRMM RMMDeviceOnlineSquadra.secRMM.RMMDeviceOnlineSquadra.secRMM.EventAlertTrueTrue
Squadra.secRMM.SerialNumberAuthorizationFailuresecRMM RMMSerialNumberAuthorizationFailureSquadra.secRMM.SerialNumberAuthorizationFailureSquadra.secRMM.EventAlertTrueTrue
Squadra.secRMM.UnknownSourceFailuresecRMM RMMUnknownSourceFailureSquadra.secRMM.UnknownSourceFailureSquadra.secRMM.EventAlertTrueTrue
Squadra.secRMM.UserAuthorizationFailuresecRMM RMMUserAuthorizationFailureSquadra.secRMM.UserAuthorizationFailureSquadra.secRMM.EventAlertTrueTrue

Agent Tasks (5)

 DisplayNameIDTargetAccessibilityCategoryEnabled
Squadra.secRMM.AuthorizeProgramsAuthorize ProgramsSquadra.secRMM.AuthorizeProgramsSquadra.secRMM.EventInternalSecurityHealthTrue
Squadra.secRMM.AuthorizeSerialNumbersAuthorize Serial NumbersSquadra.secRMM.AuthorizeSerialNumbersSquadra.secRMM.EventInternalSecurityHealthTrue
Squadra.secRMM.AuthorizeUsersAuthorize UsersSquadra.secRMM.AuthorizeUsersSquadra.secRMM.EventInternalSecurityHealthTrue
Squadra.secRMM.LockdownModesecRMM Lockdown modeSquadra.secRMM.LockdownModeSquadra.secRMM.EventInternalSecurityHealthTrue
Squadra.secRMM.MonitoringModesecRMM Monitoring modeSquadra.secRMM.MonitoringModeSquadra.secRMM.EventInternalSecurityHealthTrue

Folder Items (1)

 DisplayNameIDFolderNameElementID
Squadra.secRMM.AlertViewRemovable Media AlertsSquadra.secRMM.AlertViewMicrosoft.SystemCenter.NTServiceAndProcessMonitoring.ViewFolder.RootSquadra.secRMM.AlertView

Views (1)

 DisplayNameIDTargetTypeAccessibilityVisible
Squadra.secRMM.AlertViewRemovable Media AlertsSquadra.secRMM.AlertViewSquadra.secRMM.EventMicrosoft.SystemCenter.AlertViewTypeInternalTrue