This article explains how to set up a script that creates an alert in Atera whenever a USB flash drive is connected to a device. The script uses the Atera API, so you'll need an API token.

Create the script

1. Open Notepad and paste this script:

$usb_size = @{ Name = 'Size';Expression = { [Math]::Round( ($_.Size/1073741824), 2) } }
$usb_drives = Get-Disk | Where-Object -FilterScript { $_.Bustype -Eq "USB"} | FL -Property Model,SerialNumber,$usb_size | Out-String

IF (!($usb_drives -ieq $null)){
$headers = New-Object "System.Collections.Generic.Dictionary[[String],[String]]"
$headers.Add("Authorization", 'Bearer YOUR_API_TOKEN_HERE')

$Dguid = (Invoke-RestMethod "https://api.atera.com/api/v3/agents/machine/$ENV:COMPUTERNAME" -Headers $headers).Items.DeviceGuid
$Cid = (Invoke-RestMethod "https://api.atera.com/api/v3/agents/machine/$ENV:COMPUTERNAME" -Headers $headers).Items.CustomerID

$Body = @{
    DeviceGuid = $Dguid
    CustomerID = $Cid
    Title = "USB Drives - $(Get-Date -Format g)"
    MessageTemplate = "$usb_drives GB"
    Severity = "Information"
    AlertCategoryID = "General"
    Code = 1
}

Invoke-RestMethod -Method Post 'https://api.atera.com/api/v3/alerts' -Headers $headers -Body $Body
}
exit

2. In Atera, go to Admin > Data management > API.

The API page appears.

3. Click New token.

The Create new token panel appears.

4. Fill out the following fields:

• Token: Enter a name for the token, for example "USB alert script".
• Expiration date: Select an expiration date. The maximum is one year from the creation date.
• IP addresses: Select Allow all, or select Specific IPs to allow only the devices that will run the script.
• API permissions: Select Custom access and give the token Read permission for Agents and Write permission for Alerts. You can also select Full access.

5. Click Create, then copy the token.

Important: Copy and store the token before you close the panel. It won't be shown again.

6. In the script, replace YOUR_API_TOKEN_HERE with your token. Keep the word Bearer and the space before the token, and keep the quotes.

7. Save the script with the .ps1 file extension.

Note: The script stops working when the token expires. Before the expiration date, create a new token and replace it in the script.

Warning: The token is stored in plain text in the script. Anyone with access to the script file can use the token to access your Atera account with the permissions you gave it. Store the script in a protected location and give the token only the permissions it needs.

Set up your PC to run the script

1. In your PC's start menu, open the Event Viewer.

2. Navigate to Applications and Services Logs > Microsoft > Windows > DriverFrameworks-UserMode and click Operational.

3. Click Enable Log. Windows now logs an event whenever a USB flash drive is connected to the PC.

Now that logging is enabled, create a scheduled task that runs the script every time this event is logged.

1. In your PC's start menu, open the Task Scheduler.

2. Click Task Scheduler Library, then select Create Task on the right side.

3. On the General tab, enter a name for the task.

4. Click the Triggers tab, then click New. In the Begin the task drop-down list, select On an event, then select Custom.

5. Click New Event Filter.

6. Set Logged to Any time. Click By log and navigate to Microsoft-Windows-DriverFrameworks-UserMode/Operational. In the ID field, enter 1003.

7. Click OK in both the Triggers and the General tabs.

8. Click the Actions tab, then click New. In the Program/script field, enter Powershell.exe. In the Add arguments box, enter the following, replacing the path with the location of your script:

-windowstyle hidden 'C:\Scripts\USB_Alert.ps1'

9. Set any conditions and settings you need, then click OK to create the scheduled task.

Verify the script

1. Connect a USB drive to the PC.

2. In Atera, go to that device.

3. A new alert appears every time a USB drive is connected.