"Discovery Requiring Elevation" Report

The table displays the applications that were elevated or required admin rights.

The following columns are available for the Discovery Requiring Elevation table:

  • Description: The description of the application
  • Publisher: The publisher of the application
  • Name: The product name of the application
  • Type: The type of application
  • Elevate Method: The type of method used to elevate the application: All, Admin account used, Auto-elevated, or on-demand
  • Version: The version number of a specific application
  • # Users: The number of users
  • Median # processes / user: The median number of processes per user
  • # Hosts: The number of hosts
  • # Processes: The number of processes
  • Date first reported: The date the application was first entered in the database
  • Date first executed: The first known date the application was executed

Some of these allow you to drill down to additional information:

  • "i" icon: Opens the Target TypesApplications report filtered to that application.
  • # Users: Displays a list of users the application events came from.
  • # Hosts: Displays a list of hosts the application events came from.
  • # Processes: Displays the Events All table and lists the events received in the time period for the selected application.
  • Elevate Method: Displays the Events All table with an extra Elevate Method column.

The following quick filters are available:

  • Platform
  • Time First Reported
  • Time First Executed
  • Elevate Method
  • Path
  • Source
  • Challenge / Response
  • Matched