About Event Log Tags

The Tags data column contains "tags" for events related to applications, endpoints, policies, and servers. To learn about tags and their meanings, see the following table:

Table 1. Event Log Tags
Tag	Description	Log Types
application-start	Application start explicitly allowed or blocked by policy	Policy actions
fallback-action	Application start passively allowed because of missing rule information or an error collecting rule or application information	Policy actions
file-access	Application access explicitly allowed or blocked by policy	Policy actions
inventory	Application included in endpoint inventory	Endpoint inventories Known applications
log-only	Application start or access tracked but no actions applied because log-only mode is enabled	Policy actions
lockdown-action	Application start or access blocked because the application was added to the endpoint after a Lockdown rule was applied	Policy actions
multiuser-rule-conflict-action	Application or child-process start or access blocked by the policy of another logged on user.	Policy actions
no-connection-to-server-action	Application start or access blocked because the application was not explicitly allowed by the policy and the agent is unable to connect to the server to determine if the application should be allowed as matching a Certified Safe Software List package	Policy actions
rule-action	Application start explicitly allowed or blocked by Allow or Block rule	Policy actions
safe-match	Application exactly matches its Certified Safe Software List package	Known applications
safe-match-loose	Application in Certified Safe Software List, but not as part of its typical application package	Endpoint inventories Policy actions Known applications
safe-unchecked	Application pending look-up in Certified Safe Software List	Endpoint inventories Policy actions
safe-unknown	Application does not match any Certified Safe Software List package	Endpoint inventories Policy actions Known applications
safe-version-<version> For example, "safe-version-01.192"	Application evaluated against this Certified Safe Software version	Endpoint inventories Policy actions Known applications
trust-level-medium	Application explicitly allowed that has a Trusted Source level of Medium	Policy actions
trust-level-high	Application explicitly allowed that has a Trusted Source level of High	Policy actions
trust-level-very-high	Application explicitly allowed that has a Trusted Source level of Very High	Policy actions
trusted-source-permanent-action	Application's child-process temporarily allowed by a Trusted Source level of Medium	Policy actions
trusted-source-temporary-action	Application's child-process permanently allowed by a Trusted Source level of High or Very High	Policy actions