Privilege Management Reporting Quick Filter Panel Details

The quick filter panel has different options, depending on which report you are currently viewing.

/>
NameDescription
Platform
  • Windows: Filters by endpoints running a Windows operating system.
  • macOS: Filters by endpoints running a Mac operating system.
Time Range

The span of time that actions are audited. For example, you can filter on the number of elevated actions in the last 24 hours in the ActionsElevated report.

You can choose from:

  • 24 Hours
  • 7 Days
  • 30 Days
  • 12 Months
First Reported

This is the time range filtered by the date the application was first entered in the database. For example, you can filter on the new Windows applications by publisher that are first reported in the last 7 days in the DiscoveryBy Publisher report.

You can choose from:

  • 24 Hours
  • 7 Days
  • 30 Days
  • 6 Months
  • 12 Months
First Executed

This is the time range the application was first executed. For example, you can filter on the new Windows applications, by type that are first executed in the last 30 days in the Discovery > By Type report.

You can choose from:

  • 24 Hours
  • 7 Days
  • 30 Days
  • 6 Months
  • 12 Months
Filter by Target Type

Filter by type of target. For example, you can filter on the applications that are canceled in the time range in the Actions > Canceled report.

You can choose from:

  • All
  • Applications
  • Services
  • COM
  • Remote PowerShell
  • ActiveX
  • URL
  • Content
Filter by Action

Filter by type of action. For example, you can filter on the services that are elevated in the time range in the Target TypesServices report.

You can choose from:

  • All
  • Elevated
  • Blocked
  • Passive
  • Sandboxed
  • Canceled
Filter by App Type

Filter by application type. For example, you can filter by applications that are executables used in the time range in Target Types > Applications.

You can choose from:

  • All
  • Executable
  • Control Panel Applet
  • Management Console
  • Installer Package
  • Uninstaller
  • Windows Script
  • PowerShell Script
  • Batch File
  • Registry Settings
  • Windows Store
  • Binary
  • Bundle
  • Package
  • System Preference
  • Sudo Control
  • Script
Filter by Event Category

Filter by the category of the event. For example, you can filter by process events only that are raised in the time range in the EventsAll report.

You can choose from:

  • All
  • Process
  • DLL Control
  • Content
  • URL
  • Privileged Account Protection
  • Agent Start
  • User Logon
  • Services
Elevate Method

Filter by the elevation method used. For example, in the Discovery > Requiring Elevation report, you can filter by new applications accessed using on-demand elevation within the time range.

You can choose from:

  • All
  • Admin account used
  • Auto-elevated
  • On-demand
Path

Filter by the path. For example, filter on applications that were launched from the System path.

You can choose from:

  • All
  • System
  • Program Files
  • User Profiles
Source

The media source of the application. For example, was the application downloaded from the internet or is it from removable media?

You can choose from:

  • All
  • Any external source
  • Downloaded from internet
  • Removable media
Challenge / Response

Filter by challenge/response events. For example, you can filter the application that required elevation on those applications that were launched following a completed challenge/response message.

You can choose from:

  • All
  • Only C/R
Admin Rights

Filter by the admin rights token.

You can choose from:

  • All
  • Detected
  • Not Detected
Authorization

Filter by authorization.

You can choose from:

  • All
  • Required
  • Not Required
Group By

You can choose from:

  • All
  • Publisher
  • Application Group
  • Message
  • Workstyle
Ownership

Group by the type of owner.

You can choose from:

  • All
  • Trusted owner
  • Untrusted owner
Matched

Filter on the type of matching.

You can choose from:

  • All
  • Matched directly
  • Matched as child
Other Actions

Filter by other actions.

You can choose from:

  • Custom
  • Drop Admin Rights
  • Enforce Default Rights
DetailsProcess Details