User analytics

Gain visibility into when users log on to managed endpoints, what privileges they use (standard or administrator), and any events associated to those users.

The Users page

1. Analytics tabs: Access the Dashboard, Events, Applications, and Users pages.

2. Filters: Select a filter to refine your results. Click Clear Filters to remove all filters from your results.

   Available filters

   • Account privilege
   • Account type
   • Host domain
   • Home name
   • User domain
   • User name

3. Save View and Load View: Save your filter preferences and load the view later for quick access to your most frequently-used preferences.
4. List options: Click to refresh the list, to download the list to a .csv file, to select which columns to display on the page, and to configure your page display.
5. Columns: At-a-glance details for each user.

   Available columns

   • User Name
   • Account Privilege
   • Account Type
   • Hosts
   • Host Domains
   • User Domains
   • User Domains
   • Login Events
   • All Events
   • Last Login
   • User Identifier

View an application's user activity

On the User Activity tab, you can:

• See how many users are running an application
• The reason provided by users, if one is required
• Actions by users (allowed, blocked, etc)

To access user activity on an application:

1. Go to the Applications grid.
2. Click the link for the application you are interested in. See the following sections to learn more about the collected data.
3. Click the User Activity tab to see information about the users accessing the application.

Use the filters to dynamically update the data.

• Users Affected: Shows the number of users running the application. Drill down to see more details about the users.
• Reasons Provided: Click the link to view a breakdown of the reasons provided by users authenticating to use the application.

Application details

Click the About link on the Application Details page for deeper context of the application you are viewing. Access more information such as the application type, associated versions, the publisher, whether admin rights are required, when the event was first discovered, and when the last event occurred.

Graph data

The graph provides valuable insights with the following features:

• Default filters: The graph initially displays with two default filters, Time Period and Computer Groups. You have the flexibility to change these parameters and add filters to adjust the scope of the presented data, based on the specific information you want to see.
• Interactive Actions legend: Make use of the interactive Actions legend, which allows you to dynamically update the graph. Click to display or hide any of the available event actions to customize the information presented.
• End user metrics: Gain valuable end-user metrics, such as the frequency of event actions (Blocked, Elevated, Allowed, and Canceled), for a particular application over a defined time period.

Export to CSV

Click the Download icon to export all analytics data results in the currently filtered result set. When downloading from the Users page:

• Exports only parent rows.
• Downloads only the current page. For example, if 25 items are selected on the page, you only see the child rows for the items on the current page.
• Exports a maximum of 200 rows.
• Exports all columns.
• The parent level count is the sum of unique user names across all application versions; duplicate user names are not included in the parent level count.

Save and load views

EPM users with Analyze Group permissions can create and save a set of filters and columns so that the same set of filters does not have to be selected every time Analytics is accessed. Saving viewing preferences provides an easy way to return to views of data used frequently to monitor Endpoint Privilege Management activity in the estate.

You can load and save data sets from the Events page, Applications page, and Users page.

Access views on any device regardless of the device the views were created on.

1. After selecting filters, select Save View to retain those preferences for viewing later. Preferences are saved locally.
2. If a view name already exists, select Overwrite existing view, and then select the view you want to replace.
3. The next time you access Analytics, your view settings are preserved. Click Load View to select and load a view.
4. On the Load Event View pane, you can delete and refresh views.