How do I Determine Which Users Opened Files on My USB Drive Test?
KnowBe4's USB drive test will show you the external IP Addresses of users who opened attachments. Unless the user opened a file and also enabled the macro (in which case we'll provide you additional information, such as a user’s display name and computer name), the external IP may not indicate exactly who failed the test.
However, if you have a device in place which monitors outbound traffic (e.g. firewall or proxy), there is a method to find the internal IP of the machine that failed, allowing you to track that IP back to an individual user’s computer.
If your web traffic goes through an outbound firewall or proxy and has connection logging, you can do a search for https://training.knowbe4.com/usb_campaigns/report/ on your firewall or proxy logs. That is the domain of the KnowBe4 server the USB drive files connect to in order to record a USB drive test file as being opened. When you find the connection attempts to this URL, you should then be able to see the internal IPs in your firewall or proxy, and then track that internal IP back to your local machine that opened up the USB drive test file.
Comments