Created by Claude - please verify

USB activity - advanced hunting over DeviceEvents (UsbDriveMounted) and DeviceFileEvents (heuristic: writes to drive letters D-Z).

Required Microsoft Graph permissions

ThreatHunting.Read.All — application permission, granted to the app registration with admin consent.

Licence: Defender for Endpoint P2.

Endpoint: POST /v1.0/security/runHuntingQuery (DeviceEvents, DeviceFileEvents)

Drive letters D: to Z: can also be fixed data drives or mapped network drives - check the sample files before drawing conclusions.

If a permission is missing, this report shows a red load error with the Graph status code — not an empty table.

Removable Storage (USB) Activity (30 days)

Which devices mounted USB drives in the last 30 days, and how many files were copied to them? A starting point for data-loss investigations and for deciding whether device control policies are needed.