User analytics

Gain visibility into when users log on to managed endpoints, what privileges they use (standard or administrator), and any events associated to those users.

The Users page

1. Analytics tabs: Access the Dashboard, Events, Applications, and Users pages.

2. Filters: Select a filter to refine your results. Click Clear Filters to remove all filters from your results.

   Available filters

   • Account privilege
   • Account type
   • Host domain
   • Home name
   • User domain
   • User name

3. Save View and Load View: Save your filter preferences and load the view later for quick access to your most frequently-used preferences.
4. List options: Click to refresh the list, to download the list to a .csv file, to select which columns to display on the page, and to configure your page display.
5. Columns: At-a-glance details for each user.

   Available columns

   • User Name
   • Account Privilege
   • Account Type
   • Hosts
   • Host Domains
   • User Domains
   • User Domains
   • Login Events
   • All Events
   • Last Login
   • User Identifier

6. List navigation options: Navigate in the Events list.

View an application's user activity

On the User Activity tab, you can:

• See how many users are running an application
• The reason provided by users, if one is required
• Actions by users (allowed, blocked, etc)

To access user activity on an application:

1. Go to the Applications grid.
2. Click the link for the application you are interested in. See the following sections to learn more about the collected data.
3. Click the User Activity tab to see information about the users accessing the application.

Use the filters to dynamically update the data.

• Users Affected: Shows the number of users running the application. Drill down to see more details about the users.
• Reasons Provided: Click the link to view a breakdown of the reasons provided by users authenticating to use the application.

Application details

Click the About link on the Application Details page for deeper context of the application you are viewing. Access more information such as the application type, associated versions, the publisher, whether admin rights are required, when the event was first discovered, and when the last event occurred.

Graph data

The graph provides valuable insights with the following features:

• Default filters: The graph initially displays with two default filters, Time Period and Computer Groups. You have the flexibility to change these parameters and add filters to adjust the scope of the presented data, based on the specific information you want to see.
• Interactive Actions legend: Make use of the interactive Actions legend, which allows you to dynamically update the graph. Click to display or hide any of the available event actions to customize the information presented.
• End user metrics: Gain valuable end-user metrics, such as the frequency of event actions (Blocked, Elevated, Allowed, and Canceled), for a particular application over a defined time period.

Export to CSV

1. Sign into your EPM instance.
   The Home page displays.
2. From the left menu, click Analytics.
   The Analytics page displays.
3. Select the Users tab.
4. Clickto export all analytics data results in the currently filtered result set. The CSV download can include up to 5 million records with detailed information on account privileges.
5. When saving an export file for users:
   1. Select the maximum number of records to download.
   2. Select the columns to include. Select In View to include only the columns currently selected in your view. Select All Available to include all columns even those not currently displayed.
   3. Enter a file name.
   4. Click Prepare Download.
6. Click the Notifications icon when the file is ready to download.

Save and load views

EPM users with Analyze Group permissions can create and save a set of filters and columns so that the same set of filters does not have to be selected every time Analytics is accessed. Saving viewing preferences provides an easy way to return to views of data used frequently to monitor Endpoint Privilege Management activity in the estate.

You can load and save data sets from the Events page, Applications page, and Users page.

Access views on any device regardless of the device the views were created on.

1. After selecting filters, select Save View to retain those preferences for viewing later. Preferences are saved locally.
2. If a view name already exists, select Overwrite existing view, and then select the view you want to replace.
3. The next time you access Analytics, your view settings are preserved. Click Load View to select and load a view.
4. On the Load Event View pane, you can delete and refresh views.