View Security Events By Device, Endpoint Manager, Malware Detection, Antivirus Scan

View Security Events by Device

Click 'Security Sub-Systems' > 'Security Dashboards' > 'Device View'

Device view shows all events that occurred on a particular device.

Multiple security modules can create events on a device at different times. All these events are grouped together and shown as a single row:

Click '+' to view all events on each device

Security Dashboards - Device View - Column Descriptions
Column Header	Description
Date/Time	The time at which the event occurred.
OS	The operating system of the device.
Device Name	The device label. Click a link to view its device details.
Components	The security module that reported the event. This can be 'Antivirus', 'Containment', 'Application Control' or 'Autoruns Control'.
Action	The response to the event. This shows how the file was handled by the CCS component mentioned above. List of possible actions: Antivirus - Windows, Mac OS, and Linux devices Detection of malware Malware quarantined Malware removed from quarantine Malware restored from quarantine File was skipped by a virus scan Malware removed from infected file Detected item ignored Detected file blocked File added to exclusions File added to trusted files list File reported as false positive from the results screen Containment – Windows devices File run inside container with different restriction levels: Restricted Virtually File blocked File ignored Application Control - Windows devices File added to the file list File removed from the endpoint Trust rating updated for a file Autoruns Control - Windows devices Detected item ignored Process / service stopped Auto-run process stopped. Corresponding auto-run entry removed. In the case of a service, CCS disables the service Auto-start process quarantined. Corresponding auto-start entry removed. In the case of a service, CCS disables the service. Processes restored from quarantine File deleted from the endpoint
Last Action	Indicates what was done last on the device related to a security component, for example, file added, file deleted and so on. See above row for list of actions.
Number of Files	Shows how many file events were logged for the device. Click the number to view a list of the events.
Additional Info	Provides the current status of the event or the action taken on the affected file.
Controls
Device Details	View general information about the device. Select a device and click 'Device Details' above. You will be taken to the 'Device List' screen of the device showing information such as device summary, operating system summary and so on. See 'View Summary Information' for more details.

Sort, Search and Filter Options

Click the 'Date/Time' column header to sort events in ascending or descending order

Enter the device name in the search box to filter events involving the device

Click the funnel icon at top-right to view more filters:

Use the search fields to filter events by device, date/time, action and other criteria.

By default, 'Security Dashboards' > 'Device View' does not show files which are ignored by auto-containment rules.

Select 'Show containment ignored events' to include these files.

To display all items again, clear any search filters and click 'OK'.

You can use any combination of filters simultaneously to search for specific devices.

IT Endpoint Manager

Endpoint Manager Administrator Guide 6.43

English

View Security Events by Device