Event analytics

What are events?

Events are processes that have occurred in your EPM for Windows and Mac-managed applications.

How is the Events page useful?

Use the Events page to easily find all elevated applications, applications that are newly-matched to an application rule, or applications that are elevated by on-demand application rules.

Best practices

• When an application rule matches on a new or unknown application, we recommend you add that application to an existing policy, or create a new policy specifically for that application.
• For elevated applications, if they are higher risk applications or unwanted, we recommend you add them to a block rule.

The Events page

1. Analytics tabs: Access the Dashboard, Events, Applications, and Users pages.
2. Filters: Select a filter to refine your results. Click Clear Filters to remove all filters from your results. >

>

3. Save View and Load View: Save your filter preferences and load the view later for quick access to your most frequently-used preferences.
4. Add To Policy: Select events to add to your policy.
6. Columns: At-a-glance details for each event.

View an event's details

1. Sign into app.beyondtrust.io.
   The BeyondTrust Home page displays.
2. From the top left of the page, click > Endpoint Privilege Management for Windows and Mac > Analytics. The Analytics page displays.
3. Click Events.
   The Events page displays.
4. Locate the event you want to view.
5. Click the Event Time.
   The Event Details panel displays, where you can review the event's application, policy, process, rule script, and session data.
6. Optionally, click to open the Event Details page, which displays additional data, including COM, process hierarchy, Trusted Application Protection status, and more.

Add an event's application to a policy

📘

You can only add an event's application to an unlocked policy.

1. Sign into app.beyondtrust.io.
   The BeyondTrust Home page displays.
2. From the top left of the page, click > Endpoint Privilege Management for Windows and Mac > Analytics. The Analytics page displays.
3. Locate the event that contains an application you want to add to a policy.
4. In the event row, click .
   The Add to Policy panel displays.
5. Select an unlocked policy and available application group from the drop-down list.
6. Click Add and Edit Policy.
   The Policy Editor opens and the Applications Group page displays.
7. Edit the application settings.
8. Click Save Changes.
   The policy saves.

Look up VirusTotal score

If you are using VirusTotal, update the reputation score on the Events page or the Event Details panel. A valid reputation for an application can help you make an informed decision on how to manage that application in your policy.

EPM caches the VirusTotal score and the URL. The URLs expire after 3 days. Click the VirusTotal icon to retrieve the latest value from VirusTotal.

To see the latest VirusTotal score:

Click the score or the VirusTotal icon to open the VT Augment widget for additional insights on the reputation of the file.

On the Events page, the following information helps you evaluate the reputation score on a file:

• VirusTotal score for applications with hash.
• Integrated with VT augment widget, which returns the HTML content of the widget report for a given observable.
• VirusTotal icon next to the score ensures row level refresh for events with VirusTotal support.
• A Timestamp column with last lookup time of the VT augment.

Additionally, the Event Details panel provides the VirusTotal score and last lookup time.

📘

For more information about setting up VirusTotal, see VirusTotal Settings.

Export to CSV

1. Sign into app.beyondtrust.io.
   The BeyondTrust Home page displays.
2. From the top left of the page, click > Endpoint Privilege Management for Windows and Mac > Analytics. The Analytics page displays.
3. Select the Events tab.
4. Click the Download icon to export all analytics data results in the currently filtered result set. The CSV download can include up to 5 million records when downloading from the Events page.
5. When saving an export file for events, you can set the number of records to download, the columns to include, and a file name.
6. Click the Notifications icon when the file is ready to download. Notifications only apply to the Events page.

Save and load views

Recommended views

The recommended views provide a selection of the most useful predetermined views. Use the views to review collected data and make informed decisions around policy editing.

1. Sign into app.beyondtrust.io.
   The BeyondTrust Home page displays.
2. From the top left of the page, click > Endpoint Privilege Management for Windows and Mac > Analytics. The Analytics page displays.
3. Select the Events tab.
4. Click Load View, and then click the Recommended Views tab.

Recommended views for events load with the default filters.