"Discovery from External Sources" Report in Privilege Management for Mac

Displays all applications that have originated from an external source, such as the internet or an external drive.

You can click on the link in the Description column to see more detailed information on the application, including the actions over the last 30 days split by the type of token, the top 10 users, the top 10 hosts, the run method, and the portion of those discoveries where admin rights were detected.

The following columns are available for the macOS Discovery By Publisher table:

  • Description: The description of a specific application
  • Publisher: The publisher of the applications
  • Name: The product name of a specific application
  • Type: The type of application
  • Source: The source of the application
  • Version: The version number of a specific application
  • # Users: The number of users
  • Median # processes/user: The median number of processes per user
  • # Hosts: The number of hosts
  • # Processes: The number of processes
  • Date first reported: The date when the application was first entered into the database
  • Date first executed: The first known date that the application was executed

New applications from external sources first reported over the last <time period>

This table groups the applications by type. You can click the plus icon to expand the path to show each individual application. You can view additional information about the application, their type, version, and the number of users using them. You can click the description to see in depth information about the application.