Columns in Results Panel/Custom Report, Application Control

Shows the type of event that triggered the audit log.

Shows the type of action the administrator carried out. The can be Device Control, Application Control, or Unspecified.

Shows the name of the computer where file access was requested.

Shows the number of log entries hidden in a single row, accompanied by a grouping symbol displayed on the column header. Alternatively, The may be a computed column of data.

Indicates the reason the application is running or not running. For example, although authorized, the file may not run because the computer is in non-blocking mode or because there is a file path rule authorization.

Shows the file extension.

Shows the file group the executable, script, macro, or file containing a VBA macro assignment. The can also be shown as <Not Authorized>.

Shows the file that access was authorized or denied for.

Shows the full name (including path) of the file that access was authorized or denied.

Shows the file path for the file that access was authorized or denied.

Indicates whether the file relates to a script or an application, for example Executable or Script.

Shows the digital signature of the file, created by SHA-1 (Secure Hash Algorithm -1) that differentiate files with the same name.

Domain user name of the person who triggered the event, for example MARVIN/johns or LocalSystem.

Shows additional information for an audit event, such as, when an administrator erases a scheduled permission. The column may also show parameters.

Indicates whether an action was granted or denied. Possible values: GRANTED, DENIED, NOPERMISSIONS, LOCALAUTH, QUOTAEXCEED, NON-ENCRYPTED, SANCTUARY-ENCRYPTED, PGP-ENCRYPTED, OVERRIDESHADOW-CONFIGURED.

Shows the secondary identifier for the user, for example S-1-5-21-647365748-5676349349-7385635473-1645. The is useful when attributing actions recorded in log files to users who have left your organization.

Shows the device name for which the permissions were modified.

Shows the name of the computer that was the target of the administrator action.

Shows the name of the user or group that the administrator action was applied.

Shows the date the event occurred on the console computer.

Shows the date the event occurred on the client computer.

Shows the date (Coordinated Universal Time) the event occurred on the client computer.

Shows the date the event record was transferred from the client computer to the Ivanti Device and Application Control Application Server.

Shows the date (Coordinated Universal Time) the event record was transferred from the client computer to the Ivanti Device and Application Control Application Server.

Shows the cause of the event that triggered the log. The can be Execution Granted, Execution Denied, or the type of audit event.

Shows the name of the user who triggered the event. For users removed from the Active Directory, The field displays the SID, enabling the person who triggered an event to be identified after they have left your organization.

The file is known, its digital signature is recorded in the Ivanti Device and Application Control database. If The file is assigned to a file group, The is also shown.

The file was not allowed to run because it was not centrally or locally authorized.

The file was allowed to run because Relaxed logon default option is enabled.

The *.dll execution was authorized because the Execution Blocking option was set to Ask user for *.exe only.

The file ran and the action was logged because the option to Log Everything is enabled. The option should only be set for a limited period, or else the system generates an unmanageable amount of data.

The file is not centrally authorized, but the user was prompted for local authorization.

The file ran because the Non-Blocking option was enabled.

The file is not centrally authorized, but ran because the Non-Blocking option was enabled for a user or group of users.