Analytics: Filters | EPM-WM Pathfinder

There are two types of filtering:

Default: The default filters are: Time period, Computer groups, Operating system, Application Type (on the Applications grid only).
Optional: There is an extensive selection of filters which can be selected and configured at time of viewing.

The dynamic filtering provides a search-as-you-type feature that helps you to quickly and easily narrow the scope of the data set displayed.

Type at least three characters in the dynamic filter box of an optional filter for an auto suggestion to populate.
You can then click on an auto suggested field to help you narrow the scope of the data set.

The search as you type filtering is available for the following filter types:

App group name
App description
App Name
Application URI
Authorization URI
Auth request URI
Host Name
Host Domain
Message name
Publisher
User domain
User Name

The search-as-you-type feature is also available for these optional filters (only on the Applications grid):

COM Display Name
Service Display Name
Service Name
Store App Name

Default filters

Name	Description
Time Period	From now back to a selected value.
Computer Groups	View All or selected Computer Groups. Admin users can see data for all groups. Standard users can see data only from groups for which they have the Analyze Group role.
Operating System	Windows or macOS.
Application Type	The type of application as defined in your policy. Displays options relevant to selected operating system. Default for Applications tab only (optional for Events tab).

Filters on the Events page

Filters are grouped into the following categories:

Event: The action Endpoint Privilege Management took.
Application: Properties of the running application.
Policy: The Endpoint Privilege Management policy controlling the action.
User: The user running the event.
Computer: The machine the event is running on.

Windows

The filters listed here are optional.

Name	Category	Description
Admin Required	Application	Yes/No Endpoint Privilege Management detected that the process or application required elevation.
App Description	Application	The Product Description property of the executable (for applicable event and application types).
App Name	Application	The Product Name property of the executable (for applicable event and application types).
Application Group Name	Policy	The name of the application group matched as defined in policy.
Application Type	Application	The type of application as defined in your policy.
Authorization Method	Process	The authorization type, includes: AuthRequest, Challenge Response, Password, and Windows Hello.
Command Line	Application	The command line captured at execution time.
Elevation Method	Application	Filter by: Auto Elevated: EPM-W elevated it, based on standard application rules On Demand: EPM-W elevated it, based on User selecting Run as Administrator Admin Account: OS elevated, Administrator credentials were used Auto Authorized: EPM-M authorized it, based on standard application rules Manually Authorized: OS authorized, Administrator credentials were used
Event Action	Event	Filter by the action that Endpoint Privilege Management took for a process, as instructed by your policy. For Windows these actions are: Allowed Elevated Elevated - Custom Privileges Blocked Cancelled Self-Elevated Self-Elevated - Custom Privileges Run As Alternate User
Event Type	Event	The type of event that Endpoint Privilege Management has reported or controlled: Process Process with file COM Class Service ActiveX DLL Content Challenge Response Failed Privileged Account Modification Prevented User Logon Agent Start Agent Stop Unlicensed
Executable Path	Application	The path of the executable (the process started).
File Path	Application	The path of any file passed as an argument to a launching process.
Host Domain	Computer	Computer name on which the event took place.
Host Name	Computer	Computer domain on which the event took place.
JIT Admin Session	Session	Filters on events related to a JIT Admin session
JIT Admin Ticket Number	Session	Filters on JIT ticket numbers
Matched as Child Process	Policy	Refines your results to the most significant events for your use case.
Message Name	Policy	The message shown to end user.
On Demand	Policy	Whether the rule applied was an Application Rule (ran normally) or an On-Demand Rule (ran via right-click and Run as Administrator). Yes: On-Demand Rule No: Application Rule or N/A
Parent Process File Name	Application	The name of the parent process.
Parent Process ID	Application	The ID of the parent process.
Policy Name	Policy	The name of the policy applied.
Process ID	Application	The ID on the running process.
Publisher	Application	The publisher of the executable.
Publisher Exists	Application	Include this filter to ensure applications have an associated publisher linked to it.
User Domain	Session	The domain name for the user where the event occurred.
User Email	Session	The email address for the user logging on to EPM.
User Identifier	Session	The ID for the user.
User Name	Session	User name
User Reason	Session	The reason provided by the user via the Endpoint Privilege Management message (if configured).
Workstyle Name	Policy	The name of the Workstyle applied to this event as defined in policy.

macOS

The filters listed here are optional.

Name	Category	Description
App Description	Policy	The Product Description property of the executable (for applicable event and application types).
App Name	Application	The Product Name property of the executable (for applicable event and application types).
Application Group Name	Policy	The name of the application group matched as defined in policy.
Application Type	Application	The type of application as defined in your policy.
Application URI	Application	Refines your results to aid in making policy decisions for macOS events. Options include your organization's application URI properties.
Authorization Method	Process	The method used to authenticate: Auth request, Challenge /Response, Identity provider, password, or Smart Card.
Authorization Required	Process	Filters on if authorization is required or not.
Authorization URI	Process	The URL for the event.
Command Line	Application	The command line captured at execution time.
Elevation Method	Application	The elevation type, such as admin account, auto-elevated, or manually authorized.
Event Action	Event	Filter by the action that Endpoint Privilege Management took for a process, as instructed by your policy. For macOS these actions are: Allowed Allowed Deletable Allowed Installable Passive Blocked Cancelled
Event Type	Event	The type of event that Endpoint Privilege Management has reported or controlled: Process Process with file COM Class Service ActiveX DLL Content Challenge Response Failed Privileged Account Modification Prevented User Logon Agent Start Agent Stop Unlicensed
Executable Path	Application	The path of the executable (the process started).
File Path	Application	The path of any file passed as an argument to a launching process.
Host Domain	Computer	Computer name on which the event took place.
Host Name	Computer	Computer domain on which the event took place.
JIT Admin Session	Session	Filters on events related to a JIT Admin session
JIT Admin Ticket Number	Session	When using JIT, filter on ticket numbers.
Message Name	Policy	The message shown to end user.
On Demand	Policy	Whether the rule applied was an Application Rule (ran normally) or an On-Demand Rule (ran via right-click and Run as Administrator). Yes: On-Demand Rule No: Application Rule or N/A
Parent Process File Name	Process	The name of the parent process.
Parent Process ID	Process	The ID of the parent process.
Policy Name	Policy	The name of the policy applied.
Policy Revision	Policy	The revision of the policy applied.
Publisher	Application	The publisher of the executable.
User Domain	Session	User domain
User Email	Session	The email address for the user logging on to EPM.
User Name	Session	User name
User Reason	Session	The reason provided by the user via the Endpoint Privilege Management message (if configured).
Workstyle Name	Policy	The name of the Workstyle applied to this event as defined in policy.

Filters on the Applications page

Windows

The filters listed here are optional.

Name	Category	Description
Admin Required	Application	Endpoint Privilege Management detected that the process or application required elevation. Yes/No
App Description	Application	The Product Description property of the executable (for applicable event and application types).
App Name	Application	The Product Name property of the executable (for applicable event and application types).
Application Group Name	Policy	The name of the application group matched as defined in policy.
Downloaded	Application	Was the file downloaded? (has the mark of the web) Yes / No
Drive Type	Application	The type of drive an application or file was run or loaded. Fixed Disk CDROM Drive Network Drive USB Drive RAM Drive eSATA Drive Unknown Drive
Elevation Method	Application	How the application gained elevated rights. Possible values Windows: Admin Account On-Demand Auto-Elevated Not Elevated
Event Action	Event	Filter by the action that Endpoint Privilege Management took for a process, as instructed by your policy. For Windows these actions are: Allowed Elevated Elevated - Custom Privileges Blocked Cancelled Self-Elevated Self-Elevated - Custom Privileges Run As Alternate User
Message Name	Policy	The message shown to the end user.
On Demand	Policy	Whether the rule applied was an Application Rule (ran normally) or an On Demand Rule (ran via right click and Run as Administrator) Yes: On Demand Rule No: Application Rule or N/A
Policy Name	Policy	The name of the policy applied.
Publisher	Application	The publisher of the executable.
Publisher Exists	Application	Include this filter to ensure applications have an associated publisher linked to it.
Workstyle Name	Policy	The name of the Workstyle applied to this event as defined in policy.

macOS

The filters listed here are optional.

Name	Category	Description
App Description	Application	The Product Description property of the executable (for applicable event and application types).
App Name	Application	The Product Name property of the executable (for applicable event and application types).
Application Group Name	Policy	The name of the application group matched as defined in policy.
Authorization Required	Application	Endpoint Privilege Management detected that the process or application required Authorization macOS only Yes/No
Downloaded	Application	Was the file downloaded? (has the mark of the web) Yes / No
Drive Type	Application	The type of drive an application or file was run or loaded. Fixed Disk CDROM Drive Network Drive USB Drive RAM Drive eSATA Drive Unknown Drive
Elevation Method	Application	How the application gained elevated rights. Possible values: Manually-Authorized Auto-Authorized Not Elevated
Event Action	Event	Filter by the action that Endpoint Privilege Management took for a process, as instructed by your policy. For macOS these actions are: Allowed Passive Blocked Cancelled
Message Name	Policy	The message shown to the end user.
On Demand	Policy	Whether the rule applied was an Application Rule (ran normally) or an On Demand Rule (ran via right click and Run as Administrator) Yes: On Demand Rule No: Application Rule or N/A
Publisher	Application	The publisher of the executable.
Publisher Exists	Application	Include this filter to ensure applications have an associated publisher linked to it.
Workstyle Name	Policy	The name of the Workstyle applied to this event as defined in policy.

Application type specific filters and columns

In the Applications grid there are some filters and columns specific to the selected application type. These are available automatically when you select the appropriate application type.

Application Type	Name	Filter/Column/Both	Description
COM Class	COM Display Name	Both	The display name for the COM class object.
COM Class	CLSID	Column	The globally unique identifier that identifies a COM class object.
COM Class	App ID	Column	The globally unique identifier that represents a server process for one or more COM classes.
Management Console	File Path	Column	The path of the Management Console snap-in
Windows Service	Service Display Name	Both	The Display Name of the Windows Service
Windows Service	Service Name	Both	The underlying name of the Windows Service
Windows Service	Service Action	Column	The action which Endpoint Privilege Management controlled for that service: Start Stop Pause Configure
Windows Store Application	Store App Name	Both	The Name property of the store app.
Binary	File Path	Column	The path of the macOS binary.

📘
For more information about the Elasticsearch events in EPM, see EPM Elastic events.