diff --git a/EDR_telem_windows.json b/EDR_telem_windows.json
index 6c2c2b3..4ea9699 100644
--- a/EDR_telem_windows.json
+++ b/EDR_telem_windows.json
@@ -1083,7 +1083,7 @@
     "Telemetry Feature Category": null,
     "Sub-Category": "USB Device Unmount",
     "BitDefender": "No",
-    "C-Prot": "No",
+    "C-Prot": "Yes",
     "Carbon Black": "No",
     "Cortex XDR": "Partially",
     "CrowdStrike": "Yes",
@@ -1110,7 +1110,7 @@
     "Telemetry Feature Category": null,
     "Sub-Category": "USB Device Mount",
     "BitDefender": "No",
-    "C-Prot": "No",
+    "C-Prot": "Yes",
     "Carbon Black": "Partially",
     "Cortex XDR": "Partially",
     "CrowdStrike": "Yes",
@@ -1137,7 +1137,7 @@
     "Telemetry Feature Category": "Other Relevant Events",
     "Sub-Category": "Group Policy Modification",
     "BitDefender": "No",
-    "C-Prot": "No",
+    "C-Prot": "Yes",
     "Carbon Black": "No",
     "Cortex XDR": "Via EventLogs",
     "CrowdStrike": "No",
@@ -1164,7 +1164,7 @@
     "Telemetry Feature Category": null,
     "Sub-Category": "Volume Shadow Copy Deletion",
     "BitDefender": "Yes",
-    "C-Prot": "No",
+    "C-Prot": "Yes",
     "Carbon Black": "No",
     "Cortex XDR": "No",
     "CrowdStrike": "Yes",