Reporting

The quick panel on the left pane displays a set of predefined filters relevant to the current dashboard or report.

Below are descriptions of commonly used filter options available from the Advanced Filters link in the Filters box.

<None>
Script ran successfully
[Exception Message]
Script timeout exceeded: <X> seconds
Script execution canceled
Set Rule Properties failed validation: <reason>
Script execution skipped: Challenge Response Authenticated
Script executed previously for the parent process: Matched as a child process so cached result applied
Script execution skipped: <app type> not supported
Script execution skipped: PRInterface module failed signature check
Set RunAs Properties failed validation: <reason>

<None>
Success
Timeout
Exception
Skipped
ValidationFailure

Columns for the Windows and macOS Events All table:

• Event Time: The time of the event.
• Event Category: The category of the event.
• Platform: The platform where the event occurred.
• Description: The description of the event.
• User Name: The user name of the user who triggered the event.
• Host Name: The host name where the event was triggered.
• Workstyle: The Workstyle containing the rule that triggered the event.
• Event Type: The type of event.

Some of these columns allow you to drill down to additional information:

• Event Time: opens the event report listing all of the fields for that event.
• Description: opens the Applications Report.
• User Name: opens the User Report.
• Host Name: opens the Host Report.
• Workstyle: opens the Workstyle Report.

The Process Detail report provides a higher level of detail for Process events than the Events > All table. Other event categories are not shown in this table.

Columns for the Windows and macOS Process Details table:

• Start Time: The start time of the event.
• Platform: The platform where the event occurred.
• Description: The description of the application.
• Publisher: The publisher of the application.
• Application Type: The type of application.
• File Name: The name of the file.
• Command Line: The command line of the process that triggered the event.
• Product Name: The product name of the application.
• Product Version: The product version of the application.
• Trusted Application: The name of the trusted application.
• Trusted Application Version: The version of the trusted application.
• Group Policy Object: The name of the Endpoint Privilege Management policy (Windows only).
• Workstyle: The name of the Workstyle that the event was triggered from.
• Message: The message name if the event triggered a message.
• Action: The action associated with the event.
• Application Group: The Application Group the application assignment rule belongs to.
• PID: The process identifier of the process.
• Parent PID: The parent process identifier.
• Parent Process File Name: The parent process file name.
• Shell / Auto: Whether the process was triggered on-demand or automatically (Windows only).
• UAC Triggered: Whether user account control was triggered (Windows only).
• Admin Rights Required: Whether or not admin rights were required (Windows only).
• Authorization Required: Whether or not authorization rights were required (macOS only).
• User Name: The name of the user who triggered the event.
• Host Name: The name of the host where the event was triggered.
• Rule Script File Name: The name of the Rule Script (Power Rule).
• Rule Script Affected Rule: True when the Rule Script (Power Rule) changed one or more of the Default Endpoint Privilege Management rules, otherwise false.
• User Reason: The reason given by the user if applicable.
• COM Display Name: The COM name if applicable (Windows only).
• Source URL: The URL of the event if applicable (Windows only).
• BeyondTrust Zone Identifier: The BeyondTrust Zone Identifier if present.
• Uninstall Action: This can be None, Uninstall, Change/Modify, or Repair.
• Auth Methods: The type of authentication method selected in the Policy Editor. Multiple values can be present and are comma separated. Possible values: Identity Provider, Password, Challenge Response, Smart Card, and User Request.
• Idp Authentication User Name: The credential provided when adding an Identity Provider authorization message in the Policy Editor.

This table displays the discovered applications grouped by path. Where there is more than one application per path, click + to expand the entry to examine each application.

The following columns are available for the Windows and macOS Discovery By Path table:

• Path: The path of the applications.
• Description: The description of the application.
• Publisher: The publisher of the applications.
• Name: The product name of the application.
• Type: The type of application.
• Version: The version number of a specific application.
• # Users: The number of users.
• Median # Processes / User: The median number of processes per user.
• # Hosts: The number of hosts.
• # Processes: The number of processes.
• # Applications: The number of applications.
• Date first Reported: The date the application was first entered in the database.
• Date first Executed: The first known date the application was executed.

Some of these columns allow you to drill down to additional information:

• Description: Opens the Applications report for that application.
• # Users: Displays a list of users the application events came from.
• # Hosts: Displays a list of hosts the application events came from.
• # Processes: Displays the Events All table and lists the events received in the time period for the selected application.

This table displays the discovered applications grouped by publisher. Where there is more than one application per publisher, click + to expand the entry to examine each application.

The following columns are available for the Windows and macOS Discovery By Publisher table:

• Publisher: The publisher of the applications.
• Description: The description of the application.
• Name: The product name of the application.
• Type: The type of application.
• Version: The version number of a specific application.
• # Users: The number of users.
• Median # Processes / User: The median number of processes per user.
• # Hosts: The number of hosts.
• # Processes: The number of processes.
• # Applications: The number of applications.
• Date first Reported: The date the application was first entered in the database.
• Date first Executed: The first known date the application was executed.

Some of these columns allow you to drill down to additional information:

• Description: Opens the Applications report for that application.
• # Users: Displays a list of users the application events came from.
• # Hosts: Displays a list of hosts the application events came from.
• # Processes: Displays the Events All table and lists the events received in the time period for the selected application.

This table displays applications filtered by type. When there is more than one application per type, click + to expand the entry to see each application.

The following columns are available for the Windows and macOS Discovery By Type table:

• Type: The type of application.
• # Users: The number of users.
• Median # processes / user: The median number of processes per user.
• # Hosts: The number of hosts.
• # Processes: The number of processes.
• Applications: The number of applications.
• Date first reported: The date the application was first entered in the database.
• Date first executed: The first known date the application was executed.

Expanding the application type in the table, displays the following columns:

• Description: The description of the application.
• Publisher: The publisher of the applications.
• Name: The product name of the application.

Some of these allow you to drill down to additional information:

• Description: Opens the Target Types > Applications report which is filtered to that application.
• # Users: Displays a list of users the application events came from.
• # Hosts: Displays a list of hosts the application events came from.
• # Processes: Displays the Events All table and lists the events received in the time period for the selected application.

This table displays the applications that were elevated or required admin rights.

The following columns are available for the Windows and macOS Discovery Requiring Elevation table:

• Description: The description of the application.
• Publisher: The publisher of the application.
• Name: The product name of the application.
• Type: The type of application.
• # Users: The number of users.
• Median # Processes / User: The median number of processes per user.
• # Hosts: The number of hosts.
• # Processes: The number of processes.
• Version: The version number of a specific application.
• Elevate Method: The type of method used to elevate the application: All, Admin account used, Auto-elevated, or on-demand.
• Date First Reported: The date the application was first entered in the database.
• Date First Executed: The first known date the application was executed.

Some of these allow you to drill down to additional information:

• Description: Opens the Target Types > Applications report filtered to that application.
• # Users: Displays a list of users the application events came from.
• # Hosts: Displays a list of hosts the application events came from.
• # Processes: Displays the Events All table and lists the events received in the time period for the selected application.
• Elevate Method: Displays the Events All table with an extra Elevate Method column.

This table displays all applications that originated from an external source such as the internet or an external drive.

The following columns are available for the Windows Discovery from External Sources table:

• Description: The description of the application.
• Publisher: The publisher of the application.
• Name: The product name of the application.
• Type: The type of application.
• Source: The source of the application.
• # Users: The number of users.
• Median # Processes / User: The median number of processes per user.
• # Hosts: The number of hosts.
• # Processes: The number of processes.
• Version: The version number of the application.
• Date First Reported: The date the application was first entered in the database.
• Date First Executed: The first known date the application was executed.

Some of these allow you to drill down to additional information:

• Description: Opens the Applications report for that application.
• # Users: Displays a list of users the application events came from.
• # Hosts: Displays a list of hosts the application events came from.
• # Processes: Opens the Events All table and lists the events received in the time period for the selected application.

This table lists all applications discovered in the time period, grouped by the application description so that if multiple versions of the same application exist, they are grouped on the same line. Click + in the Version column to expand the list.

The following columns are available for the Windows and macOS Discovery All table:

• Description: The description of the application.
• Publisher: The publisher of the application.
• Name: The product name of the application.
• Type: The type of application.
• Version: The version number of the application.
• # Users: The number of users.
• Median # Processes / User: The median number of processes per user.
• # Hosts: The number of hosts.
• # Processes: The number of processes.
• Date First Reported: The date the application was first entered in the database.
• Date First Executed: The first known date the application was executed.
• Name: The product name. This is hidden by default but you can select it from the Actions > Choose Columns menu.

Some of these columns allow you to drill down to additional information:

• Description: Opens the Applications report for that specific application.
• # Users: Displays a list of users the application events came from.
• # Hosts: Displays a list of hosts the application events came from.
• # Processes: Displays the Events All table.

This dashboard shows how users interacted with Messages, Challenge/Response dialog boxes, and the Shell (On-Demand) menu.

This dashboard shows how many accounts with Standard rights, Power User rights and Administrator rights generated logon events filtered by the time frame.

This dashboard shows any blocked attempts to modify privileged accounts over the specified time interval.