For general best practices related to events, see Events in Server & Workload Protection.
To see the Device Control events captured by Server & Workload Protection, go to Events & Reports > Events > Device Control Events > Security Events.
What information is displayed for Device Control events?
These columns can be displayed on the Device Control Events page. You can click Columns to select which columns are displayed in the table.
- Time: The time that the event took place on the computer.
- Computer: The computer on which this event was logged. (If the computer has been removed, this entry will read "Unknown Computer".)
- Device Type: The device type that was accessed to cause the event; for example, USB.
- Target: The file name that was accessed that caused the event to be triggered.
- Accessed By: The process name that caused the event to be triggered.
- Action Taken: The action that Device Control took.
- Vendor: The name of the vendor of the device.
- Model: The model name or number of the device.
- Serial Number: The serial number of the device.
- Product: The device name that was accessed to cause the event.
- Tag(s): Any event tags associated with this event.
- Event Origin: The Server & Workload Protection component from which the event originated.