> ## Documentation Index
> Fetch the complete documentation index at: https://syteca.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.
# USB Monitoring Rules
> Add, edit, and delete USB monitoring rules in Syteca, define exceptions for individual devices by Hardware ID or VID/PID, and find a device's Hardware ID.
USB monitoring rules let you alert on, block, or gate-by-approval specific USB device classes on Windows and macOS Clients. This page covers the full rule lifecycle — adding, editing, deleting — plus the two related tasks you'll use frequently: defining exceptions for individual devices, and finding a device's Hardware ID.
For the conceptual overview, the list of device classes available, and the difference between automatic and rule-based monitoring, see [USB Device Monitoring & Blocking](/docs/session-monitoring/usb-devices/overview).
Rules can only be added, edited, or deleted by a user with the [administrative Client Installation and Management permission](/docs/administration/users/administrative-permissions).
## Add a USB monitoring rule
Sign in to the Management Tool, click **USB Devices** in the left navigation, then click **Add** in the top right.
On the **USB Rule Properties** tab:
* Select **Enable USB rule** to enable the rule.
* Enter a unique **Name** for the rule.
* Optionally enter a **Description**.
* Select the required **Risk Level**.
Click **Next**.
On the **Rule Conditions** tab, select the device classes to monitor in the **Monitored Devices** list. See [the device class reference](/docs/session-monitoring/usb-devices/overview#usb-device-classes-available-for-rule-based-monitoring) for what each class covers.
Only **Mass storage devices** and **Vendor-specific devices** are currently supported for macOS Clients.
Then add [exceptions](#define-exceptions) for any individual devices that should remain usable, and click **Next**.
On the **Additional Actions** tab, configure what the rule does:
**In the Notifications section:**
* **Send email notification to** — receive an email when a device is detected.
Email notifications require the [Email Sending Settings](/docs/administration/configuration/email-sending-settings) to be configured correctly.
* **Show warnings in Tray Notifications application** — show a notification in the [Syteca Tray Notifications application](/docs/administration/deployment/tray-notifications) on the user's computer.
**In the Actions section** *(only one blocking action can be selected; Windows only):*
* **Block access to mass storage device until administrator's approval** — block the device until a trusted user (Approver) grants access. See [USB access approval](/docs/session-monitoring/usb-devices/usb-access-approval) for the user-side workflow. Optionally enter a custom message to show when the device is connected.
By default, access requests expire if not processed within 30 minutes. Change this in [System Settings](/docs/administration/configuration/system-settings) on the Configuration page. Approvers must have valid email addresses on their [user account](/docs/administration/users/users#edit-a-user) to receive email requests.
* **Block USB device** — block the device unconditionally on all assigned Clients. Affects all users regardless of user filtering.
* **Notify user on the target computer about device blocking** — show a custom message (max 250 characters) as a balloon notification when a blocked device is plugged in.
If no action is selected, devices detected by the rule only appear in the Session Viewer (no alerts, no blocking).
Click **Next**.
On the **Assigned Clients** tab, click **Add** in the **Clients** or **Client Groups** section and pick the Clients or groups the rule applies to.
Use the **Search** box to find specific Clients or Client groups.
Click **Finish** in the bottom right. The rule appears in the grid on the USB Devices page.
If a rule is created **while a target device is already plugged in**, blocking will not take effect on that device until the user unplugs and re-plugs it.
## Edit a USB monitoring rule
On the **USB Devices** page, click the **Edit Rule** icon next to the rule you want to change.
Edit the rule on each tab the same way as when [adding a rule](#add-a-usb-monitoring-rule), then click **Finish**.
## Delete a USB monitoring rule
On the **USB Devices** page, click the **Edit Rule** icon next to the rule.
On the **USB Rule Properties** tab, click **Delete Rule** at the bottom of the page, then click **Delete** in the confirmation message.
If the rule was blocking any plugged-in devices, users will need to unplug and re-plug those devices before they can be used.
## Define exceptions
The **exceptions list** contains the individual USB devices that the rule will **not** monitor or block — even though they match one of the monitored device classes. Unlike the Monitored Devices list (which is by *class*), exceptions are added one device at a time.
Add all permitted USB devices to the exceptions list **before** enabling a blocking rule. A blocking rule with no exceptions can lock out keyboards, mice, license dongles, and other peripherals your users depend on.
Exceptions are added on the **Rule Conditions** tab while adding or editing a rule.
On the **Rule Conditions** tab, scroll down to **Exceptions** and click **Add**.
In **Add Exception**, choose how to identify the device:
Enter the [Device Hardware ID](#find-a-device’s-hardware-id) of the device.
Enter the **Vendor ID (VID)**, **Product ID (PID)**, **Revision**, and **Serial** number in the respective fields.
* **VID and PID are required.** Revision and Serial are optional.
* You can use the `*` **wildcard** as the *entire* value in any one of the four fields (but not combined with other characters). This is also useful when a Hardware ID contains characters the system won't accept, such as `?`.
Enter a **Description** so future admins know why the exception exists (e.g. *"Engineering team Yubikeys"*, *"CFO laptop USB-C dock"*).
Click **Add** in the bottom right. The device joins the list of exceptions for this rule.
Click **Finish** to save the rule with the new exception applied.
## Find a device's Hardware ID
The Hardware ID is the most specific way to identify a single USB device in an exception. To view it on Windows:
Plug the USB device into your Windows computer.
Right-click **This PC** and select **Manage**.
Expand the **Device Manager** node.
Expand the node with the computer's name in the central pane, then expand **Universal Serial Bus Controllers**.
Right-click the device, choose **Properties**, select the **Details** tab, then select **Hardware Ids** in the **Property** drop-down. The Hardware ID appears in the **Value** field — copy it into the exception's **Quick selection** field.
## Related
The conceptual overview, device class reference, and how automatic vs rule-based monitoring differ.
The Approver and user-side workflow for "block until approved" rules.
Where rule-triggered USB events appear alongside other endpoint alerts.
Process USB and PAM access requests in one place.