Our local forensics guy suggested this enhancement. Symantec Endpoint Protection creates entries for malware detections in Windows Application event logs so it would be useful to add Application Control detections, namely "Log files written to USB drives", to Windows Application event logs too.
↧
