Event analytics

What are events?

Events are processes that have occurred in your EPM for Windows and Mac-managed applications.

How is the Events page useful?

Use the Events page to easily find all elevated applications, applications that are newly-matched to an application rule, or applications that are elevated by on-demand application rules.

Best practices

• When an application rule matches on a new or unknown application, we recommend you add that application to an existing policy, or create a new policy specifically for that application.
• For elevated applications, if they are higher risk applications or unwanted, we recommend you add them to a block rule.

The Events page

2. Filters: Select a filter to refine your results. Click Clear Filters to remove all filters from your results.

   Available filters

   Event Time Event Type Event Action Application Type Publisher App name App description Executable Path File Path Admin Required Computer Groups Operating System Host Name Host Domain User Name User Domain User ID User Domain ID Policy Name Policy Revision Operating System Host Name Host Domain User Name User Domain User ID User Domain ID Policy Name Policy Revision Message Name Workstyle Name Application Group Application Description Rule Action User Reason Application URI

   On Demand Token Token Description Command Line Process ID Application Group Application Description Rule Action User Reason On Demand Token Token Description Command Line Process ID Parent Process ID App Version Drive Type Host ID Host Domain ID Authorizing User Domain ID Authorizing User Name IP Addresses File Owner ID File Owner Name File Owner Domain Name Parent Process File Name Parent Process ID Download URL Authorization Challenge Code Unique Process ID Product Code Upgrade Code Authorization Method JIT Admin Session JIT Admin Ticket Number Elevation Method Matched as Child Process

3. Save View and Load View: Save your filter preferences and load the view later for quick access to your most frequently-used preferences.
4. Add To Policy: Select events to add to your policy.
6. Columns: At-a-glance details for each event.
7. List navigation options: Navigate in the Events list.

View an event's details

3. Locate the event you want to view.
4. Click the Event Time.
   The Event Details panel displays, where you can review the event's application, policy, process, rule script, and session data.
5. Optionally, click to open the Event Details page, which displays additional data, including COM, process hierarchy, Trusted Application Protection status, and more.

Add an event's application to a policy

Look up VirusTotal score

If you are using VirusTotal, update the reputation score on the Events page or the Event Details panel. A valid reputation for an application can help you make an informed decision on how to manage that application in your policy.

EPM caches the VirusTotal score and the URL. The URLs expire after 3 days. Click the VirusTotal icon to retrieve the latest value from VirusTotal.

To see the latest VirusTotal score:

Click the score or the VirusTotal icon to open the VT Augment widget for additional insights on the reputation of the file.

On the Events page, the following information helps you evaluate the reputation score on a file:

• VirusTotal score for applications with hash.
• Integrated with VT augment widget, which returns the HTML content of the widget report for a given observable.
• VirusTotal icon next to the score ensures row level refresh for events with VirusTotal support.
• A Timestamp column with last lookup time of the VT augment.

Additionally, the Event Details panel provides the VirusTotal score and last lookup time.

ℹ️

For more information about setting up VirusTotal, see VirusTotal Settings.

Export to CSV

3. Clickto export all analytics data results in the currently filtered result set. The CSV download can include up to 5 million records when downloading from the Events page.
4. When saving an export file:
   1. Select the maximum number of records to download.
   2. Select the columns to include. Select In View to include only the columns currently selected in your view. Select All Available to include all columns even those not currently displayed.
   3. Enter a file name.
   4. Click Prepare Download.
5. Click the Notifications icon when the file is ready to download. Notifications only apply to the Events page.

Save and load views

Recommended views

The recommended views provide a selection of the most useful predetermined views. Use the views to review collected data and make informed decisions around policy editing.

1. To access the views, go to Analytics.
2. Click the Events tab.
3. Click Load View, and then click the Recommended Views tab.

Recommended views for events load with the default filters.