I’ve written a query to monitor when a USB is plugged or unplugged from a machine on my network. I want to build it out to not alert if I put the devices serial number in a list.

DeviceEvents
| where ActionType == "UsbDriveMounted" or ActionType == "UsbDriveUnmounted"
| join kind=inner DeviceInfo on $left.DeviceId == $right.DeviceId
| project Timestamp, DeviceId, DeviceName, ActionType, FileName, FolderPath, SerialNumber
| sort by Timestamp desc

This is the query and it works minus the Serial Number. Once I put that field in it no longer evaluates.
I see that it is a supported feild in this article.

But in that article the UsbDriveMounted event is UsbDriveMount where later on in this article they talk about updates to the advanced hunting schema.

Is there any way to get this query to give me the serial number of the usb devices?

I put in the SerialNumber feild and expect it to add a column to the table that gives that info but it fails out and gives me the error message:

Semantic error
Error message
'project' operator: Failed to resolve scalar expression named 'SerialNumber'
How to resolve
Fix semantic errors in your query