Insert Applications from Events (Event Import)
The Privilege Management for Windows Workstyle editor allows you to add applications that have been audited by Privilege Management for Windows clients. Adding applications from events provides a simple and integrated workflow for defining rules based on real application usage.
To add an application from an event:
- Select the relevant Application Group.
- In the right pane, select Actions > Add Apps From Events. The Events page appears.
- Use the filters and search box to locate an audited application or scroll through the available audited applications.
- Select an application and click Add Application(s) to Group.
- Repeat steps 3 and 4 until all desired applications have been added.
- Click Finish to exit and return to the Application Group.
The Events page includes the following filters:
- Preset Add: Create a new custom filter that can be saved and then selected from the Preset dropdown list.
- Preset Delete: Delete the currently selected preset.
- New Apps Only: If checked, the list is filtered on those apps where the Date First Recorded is within the Date Executed range.
- Preset Edit: Create and edit custom filters that are saved and can be selected from the Preset dropdown menu.
- Preset: Select any previously created custom filters in addition to the standard time filters provided.
- Quick Find Column: A selection of default quick filters.
- Quick Find: Enter text to find applications. Entered text will match against the Quick Find Column selection. For example, to filter on a specific username, click User from the Quick Find Column, and type the username in the Quick Find box and click Apply.
- Database: Toggles between searching the Reporting database and the ePO database.
- Hide: Hide applications already added to apps in current group or apps in any group.
Once the search criteria has been entered, the page automatically returns a list of unique applications that were audited, matching the criteria you specified. From here you can browse the list.
Once the applications have been added to the Application Group, you can edit the definitions. All definitions are prepopulated with values collected from the application.
For queries that are taking a long time to execute, you can click the Cancel Query button if you wish to cancel the query.
A unique application is based on the Product Description of the application, so if two or more audited applications share the same Product Description, they are displayed as a single application.
For the Update Reputation option to be available, the BeyondTrustPrivilege Management Reputation Settings on the ePO's Configuration > Server Settings page must be enabled.
You can update the reputation from this page.
- Check the box adjacent to the rows you wish to update the reputation for.
- Select Actions > Update Reputation.