https://www.ossec.net/docs/docs/manual/monitoring/process-monitoring.html#detecting-usb-storage-usage The USB example Command is used in this file  https://www.ossec.net/docs/docs/syntax/head_ossec_config.localfile.html?highlight=localfile#element-localfile But I'm told here that it's not allowed 
