What does the ARO: Removable Drive Detected mean?

Introduction

Field Effect generates this ARO when someone attaches a removable drive to a monitored endpoint.  One "Removable Drive Detected" ARO is generated per host/drive combination and plugging a different drive into the same host will also generate a new ARO.

Dismissing this ARO will only prevent future AROs when plugging the same removable drive into the same endpoint. If you plug a different removable drive into the same host, or the same drive into a different endpoint, Field Effect generates a new ARO.

Resolving this ARO will only acknowledge this alert.  Plugging the removable drive back into the endpoint will trigger the alert.