List USB device connection events

POST

/devices/usb-connections

Query and filter USB device connection events. These events track when USB devices
are connected to devices in your environment, including device identification and risk assessment.
Disconnected connections are included; filter on disconnected_time IS NULL for ones still connected.

Relations:

device (Device): The device where the USB connection occurred

Request

Authorization

Body Params application/jsonRequired

Examples

Responses

🟢200OK

application/json

Successful operation

Bodyapplication/json

🟠400Bad Request

🟠401Unauthorized

🟠403Forbidden

Request Example

Shell

JavaScript

Java

Swift

curl --location '/devices/usb-connections' \
--header 'Content-Type: application/json' \
--data '{
    "distinct_count": "string",
    "distinct_on": "host_name",
    "include_total_count": true,
    "limit": 10,
    "offset": 0,
    "query": "name='\''WINPC-4291'\'' AND status IN ('\''active'\'', '\''pending'\'')",
    "sort": "name desc, id"
}'

Response Example

{
    "distinct_values": [
        {
            "count": 0,
            "value": null
        }
    ],
    "pagination": {
        "count": 0,
        "total_count": 1000
    },
    "items": [
        {
            "connection_count": 5,
            "device": {
                "activation_lock": "unspecified",
                "active_usb_connections": {
                    "composite_count": 0,
                    "hid_count": 2,
                    "kvm_count": 0,
                    "max_usb_risk_level": 1,
                    "network_adapter_count": 0,
                    "storage_count": 1,
                    "unknown_count": 0
                },
                "antivirus": "unspecified",
                "apps_installed": 47,
                "disk_encryption": "unspecified",
                "employee_email": "joe.smith@example.com",
                "employee_name": "Joe Smith",
                "id": "8CA67511-744C-4D74-B26E-7281CF88712F",
                "last_seen": "2021-01-01T00:00:00Z",
                "last_usb_usage": "2021-01-01T00:00:00Z",
                "local_user_accounts": [
                    {
                        "admin": true,
                        "name": "John Doe",
                        "user_id": "S-1-5-21-1234567890-1234567890-1234567890-1001",
                        "username": "john.doe"
                    }
                ],
                "mac_addresses": [
                    "00:1B:44:11:3A:B7"
                ],
                "mdm": "unspecified",
                "model": "MacBook Pro",
                "name": "Joe's Mac",
                "platform": "windows",
                "risk_factors": [
                    {
                        "magnitude": 40,
                        "type": "sensitive_file"
                    }
                ],
                "risk_score": 9.2,
                "serial_number": "C02X1234DC79",
                "sources": [
                    "unspecified"
                ]
            },
            "device_instance_id": "USB\\VID_1050&PID_0407\\serial&2",
            "device_serial_number": "123456789",
            "device_type": "hid",
            "disconnected_time": "2024-01-15T11:00:00Z",
            "latest_connected_time": "2024-01-15T10:30:00Z",
            "manufacturer": "Yubico",
            "network_origin": {
                "geographic_location": {
                    "city": "San Francisco",
                    "country": "United States",
                    "country_code": "US",
                    "latitude": 0,
                    "longitude": 0,
                    "region": "California",
                    "timezone": "America/Los_Angeles"
                },
                "ip": "203.0.113.45",
                "network": {
                    "asn": "AS15169",
                    "asn_name": "Google LLC",
                    "host_type": [
                        "HOSTING",
                        "ANYCAST"
                    ]
                },
                "privacy": {
                    "privacy_mode": [
                        "VPN"
                    ],
                    "service_name": "NordVPN"
                }
            },
            "product_id": 1031,
            "product_name": "YubiKey OTP+FIDO+CCID",
            "risk_level": 0,
            "vendor_id": 4176
        }
    ]
}

Modified at 2026-10-20 18:32:30

Get a device policy

Get a USB connection event