Application Event Inbox
The Application Event Inbox collects the application control events of the endpoints in a single list. Kron PAM groups the events of the same application, so you review the activity of an application across every agent in one record instead of reading the logs agent by agent. From a record, you create an advanced application policy for that application.
To display the inbox, navigate to Windows Agent Management > Application Event Inbox.
To find an application, enter its name in the Search process name field. To narrow the list, select a value in the Reputation list or in the Event Result list. To switch between the basic and the advanced filter, click the filter button. To update the list with the latest events, click the refresh button. You sort the list by Process Name, Vendor, Reason, Result, Agent Count, Event Count, Last Event Time.[ZÖ1]
The following table describes the columns of the list:
Table X: Application Event Inbox Columns | |
|---|---|
Column | Description |
Process Name | The name of the application that the end user runs. |
Vendor | The vendor of the application. |
Agent Count | The number of the agents on which the application runs. |
Event Count | The number of the events that the agents report for the application. |
Last Event Time | The time of the most recent event. |
Reputation | The risk level of the application, based on its external reputation score. The values are Not Risky, Low Risk, Risky, and High Risk. |
Reason | The policy or the agent mode that produces the result, such as Learning Mode or Black Mode Sub Process. |
Result | The action that the agent applies to the application: Allowed, Blocked, or Elevated. |
Actions | Opens the Event Details window of the application. |
[ZÖ1]@Hasan Onur KARACA PAM-19442. Can you please check?