The Linux Tracking Policy in Swif.ai enables visibility into key security and operational events occurring on Linux devices. This policy allows organizations to track USB activity and device lock/unlock behavior, providing the same level of visibility available on macOS and Windows endpoints.
This policy is used together with Swif.ai’s event tracking system.
The policy supports both BYOD and company-owned Linux devices.
What This Policy Does
When enabled, the Linux Tracking Policy allows Swif.ai to collect and report the following:
USB connection and disconnection events
Gain visibility into when external storage or USB hardware is attached or removed.Device lock and unlock events
Track when the workstation session is locked or unlocked, providing insight into user behavior and endpoint activity.
This information helps IT and Security teams:
Strengthen compliance (SOC 2, ISO 27001, HIPAA)
Monitor external device usage
Detect suspicious activity
Perform incident investigations
Understand device usage patterns across remote and hybrid teams
Requirements
Linux (any Swif-supported distribution)
Policy Settings
USB Connection Tracking
Controls whether Swif.ai logs USB attach/detach events.
Options:
True – Enables USB tracking
False – Disables USB tracking
Minimum requirements: Linux
Device Lock Tracking
Controls whether Swif.ai logs device lock/unlock events.
Options:
True – Enables device lock event tracking
False – Disables lock event tracking
Minimum requirements: Linux
How Event Tracking Works in Swif.ai
Once the policy is enabled and applied to devices, event logs appear in:
Report → Event Logs → Device Events
This provides auditors and administrators with clear visibility into endpoint behavior.
Use Cases
✔ Compliance & Audit Trails
Track session activity and USB usage to support SOC 2, ISO 27001, HIPAA, and internal audit frameworks.
✔ Security Monitoring
Detect unauthorized USB access, suspicious unlock patterns, or unusual device interactions.
✔ Incident Response
Reconstruct user and device activity around security events.
✔ Remote Workforce Visibility
View device lock times and USB usage across distributed teams.
✔ Behavioral Insights
Identify patterns such as inactive devices, after-hours access, or repeated USB attachments.
Verification & Troubleshooting
Verify tracking is working
Go to Reports
Open the Event Logs
Confirm you see:
USB connection events
Lock/unlock events
If events are not appearing:
Ensure the Linux Tracking Policy is applied
Confirm the Swif agent is installed and running
Check for required system permissions
Restart the device if necessary
Best Practices
Enable tracking for all company-owned Linux devices
Combine with:
Linux USB Policy for USB enforcement
Linux Security or Login Policies for identity controls
Linux AntiVirus Detection for endpoint protection
Use automations to alert on:
Suspicious USB device connections
Unexpected unlocks
After-hours device activity