Hey,
You will need to install the LEM Agent & USB Defender on each machine you want to monitor. When a user copies a file to a USB it generally appears as a FileCreate event like below. If they modify the file it will probably appear as a FileWrite event.
You could create a rule something like this:
I haven't tested that rule, but something along those lines should do the trick