{
    "groups": [
        {
            "$type": "device",
            "id": "3f082cd3-f701-4c21-9a6a-ed115c28e211",
            "name": "All Removable Media Devices",
            "query": {
                "$type": "all",
                "clauses": [
                    {
                        "$type": "primaryId",
                        "value": "removable_media_devices"
                    }
                ]
            }
        },
        {
            "$type": "device",
            "id": "3f082cd3-f701-4c21-9a6a-ed115c28e212",
            "name": "Kingston Devices",
            "query": {
                "$type": "all",
                "clauses": [
                    {
                        "$type": "vendorId",
                        "value": "0951"
                    }
                ]
            }
        }
    ],
    "rules": [
        {
            "id": "772cef80-229f-48b4-bd17-a69130092981",
            "name": "Deny RWX to all Removable Media Devices except Kingston",
            "includeGroups": [
                "3f082cd3-f701-4c21-9a6a-ed115c28e211"
            ],
            "excludeGroups": [
                "3f082cd3-f701-4c21-9a6a-ed115c28e212"
            ],
            "entries": [
                {
                    "$type": "removableMedia",
                    "id": "A7CEE2F8-CE34-4B34-9CFE-4133F0361035",
                    "enforcement": {
                        "$type": "deny"
                    },
                    "access": [
                        "read",
                        "write",
                        "execute"
                    ]
                },
                {
                    "$type": "removableMedia",
                    "id": "18BA3DD5-4C9A-458B-A756-F1499FE94FB4",
                    "enforcement": {
                        "$type": "auditDeny",
                        "options": [
                            "send_event",
                            "show_notification"
                        ]
                    },
                    "access": [
                        "read",
                        "write",
                        "execute"
                    ]
                }
            ]
        }
    ],
    "settings": {
        "features": {
            "removableMedia": {
                "disable": false
            }
        },
        "global": {
            "defaultEnforcement": "allow"
        },
        "ux": {
            "navigationTarget": "http://www.microsoft.com"
        }
    }
}