USB device plugged-in notifications

Personal security: if someone plugs a flash drive into your computer (or you connect the wrong drive yourself), it’s nice to know instantly — with the model, vendor and serial number of the device. On Linux this is done with plain udev, no third-party daemons.

Linux: a udev rule

Put the script that udev will call when a drive is connected into /usr/local/bin/notifly-usb:

#!/usr/bin/env bash
# /usr/local/bin/notifly-usb   — called from udev on add
set -eu
set -a; source /etc/notifly.env; set +a

# Attributes come from udev as environment variables.
VENDOR="${ID_VENDOR:-неизвестно}"
MODEL="${ID_MODEL:-неизвестно}"
SERIAL="${ID_SERIAL_SHORT:-нет}"
DEV="${DEVNAME:-?}"

curl -fsS -X POST "$NOTIFLY_URL/message?token=$NOTIFLY_TOKEN" \
    -H "Content-Type: application/json" \
    --data "$(jq -n \
        --arg t "🔌 USB подключён: $VENDOR $MODEL" \
        --arg m "Устройство: $DEV
Серийный №: $SERIAL
Хост: $(hostname)" \
        --argjson p 7 \
        '{title:$t, message:$m, priority:$p}')" >/dev/null

sudo chmod 755 /usr/local/bin/notifly-usb

The rule itself — /etc/udev/rules.d/99-notifly-usb.rules. React only to the arrival (add) of USB storage (block devices on the usb bus):

ACTION=="add", SUBSYSTEM=="block", ENV{ID_BUS}=="usb", ENV{DEVTYPE}=="disk", \
    RUN+="/usr/local/bin/notifly-usb"

Reload the rules — the new one fires on the next plug-in:

sudo udevadm control --reload-rules

Check which variables arrive

To see what udev knows about the device (and tune the message):

udevadm info --query=property --name=/dev/sdb

React to any USB device at all

If you need not just storage but mice/keyboards/phones — a rule by the usb subsystem:

ACTION=="add", SUBSYSTEM=="usb", ENV{ID_VENDOR}!="", \
    RUN+="/usr/local/bin/notifly-usb"

Windows: a WMI event subscription

On Windows a drive plug-in is recorded in the event log and in WMI. The simplest option is a scheduled task on an event: source Microsoft-Windows-Kernel-PnP, Event ID 2003 (device configured). Assumes a configured function Send-Notifly.

The handler script:

. $env:USERPROFILE\Documents\WindowsPowerShell\Notifly.ps1

# Take the last-connected USB storage device.
$disk = Get-CimInstance Win32_DiskDrive |
    Where-Object { $_.InterfaceType -eq "USB" } |
    Sort-Object -Property Index -Descending | Select-Object -First 1

$model  = if ($disk) { $disk.Model }        else { "неизвестно" }
$serial = if ($disk) { $disk.SerialNumber } else { "нет" }

Send-Notifly -Title "🔌 USB подключён: $model" `
             -Message "Серийный №: $serial`nХост: $env:COMPUTERNAME" -Priority 7

Bind it to the event (one-off, from an elevated PowerShell):

$Trigger = New-CimInstance -CimClass (Get-CimClass MSFT_TaskEventTrigger `
    -Namespace Root/Microsoft/Windows/TaskScheduler) -ClientOnly
$Trigger.Subscription =
  "<QueryList><Query Id='0'><Select Path='Microsoft-Windows-Kernel-PnP/Configuration'>" +
  "*[System[EventID=2003]]</Select></Query></QueryList>"
$Trigger.Enabled = $true

$Action = New-ScheduledTaskAction -Execute "powershell.exe" `
    -Argument "-NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -File C:\scripts\Notifly-Usb.ps1"
Register-ScheduledTask -TaskName "Notifly USB Alert" -Action $Action -Trigger $Trigger

An alternative without the scheduler is a permanently running WMI subscription via Register-CimIndicationEvent on Win32_VolumeChangeEvent (type 2 = arrival).

Benefits

Physical security. You learn about a stranger’s flash drive even when you’re not around.
Serial in your pocket. By ID_SERIAL_SHORT you tell your own drive from someone else’s.
Audit trail. Each push is a history entry: when and what was plugged into the machine.

Further improvements

Keep a whitelist of serials — send your own devices quietly (priority 2) and strangers loudly (priority 8).
On remove send “USB unplugged” — you can see how long the device stayed in.
For workstations — centralize via monitoring.