VQL Reference Event Plugins watch_usn watch_usn Plugin Arg Description Type device The device file to open (as an NTFS device). string (required) Required permissions: FILESYSTEM_READ Description Watch the USN journal from a device.