"Discovery Requiring Elevation" Report

The table displays the applications that were elevated or required admin rights.

The following columns are available for the Discovery Requiring Elevation table:

Description: The description of the application
Publisher: The publisher of the application
Name: The product name of the application
Type: The type of application
Elevate Method: The type of method used to elevate the application: All, Admin account used, Auto-elevated, or on-demand
Version: The version number of a specific application
# Users: The number of users
Median # processes / user: The median number of processes per user
# Hosts: The number of hosts
# Processes: The number of processes
Date first reported: The date the application was first entered in the database
Date first executed: The first known date the application was executed

Some of these allow you to drill down to additional information:

"i" icon: Opens the Target Types > Applications report filtered to that application.
# Users: Displays a list of users the application events came from.
# Hosts: Displays a list of hosts the application events came from.
# Processes: Displays the Events All table and lists the events received in the time period for the selected application.
Elevate Method: Displays the Events All table with an extra Elevate Method column.

The following quick filters are available: