Viewing event history

To view or export the Events page, your role needs to be granted the View permission for Audit Event History. All Administrators are granted this permission by default.

To open the Events page, click History > Events on the navigation bar.

The Events page includes a default collection of event information organized in the following columns:

• Date: the date and time that the event occurred, expressed in your local time zone

  Note that the date and time shown depends on the type of event:

  Event	Details
  Anti-malware, Encryption, Hardware, and Geolocation events that occur on a device	The Date column shows the date and time that the Secure Endpoint Agent detected new or updated information on the device.
  Freeze, File Delete, Run Script, Send Message, and Wipe events that occur on a device	The Date column shows the date and time that the device action event occurred on the device. Also see Reported date. If the event occurred on the server, such as Freeze requested, the server date and time is shown.

  For all other events, the Date column shows the date and time that the event occurred on the server.
  

• Event: the event that occurred

• Summary: shows details about the event, such as the user who initiated the event, the device [device name The name assigned to the device in the operating system. For Chromebooks, device name is not applicable and therefore shows as "Chrome" in the Secure Endpoint Console. (serial number The identification number assigned to the device by the device manufacturer. For Windows devices, this value may correspond to the serial number of the BIOS, the motherboard, or the chassis, depending on the manufacturer.)] that was affected, the name of the item that changed, and the properties that were updated.

  A icon indicates that a new page will open when you click the link. Depending on the type of event and the information shown, you can:

  • Click a username to open the Users page in Settings > User Management.
  • Click a device name (serial number) to view the device's Device Details page.
  • Click a rule name to open the rule configuration dialog.
  • Click a device group to view the devices in the group.
  • Click a geofence A boundary that defines the geographical area within which you allow (or disallow) your devices to reside. name to view the geofence's boundaries on a map.
  • Click a place name to view the updated location properties in a dialog.
  • Click a theft report ID to view the report details.
  • Click a role to view its permissions and assigned users.
  About Reported date

  If Reported date shows in the Summary area, it shows the date and time that the event information was uploaded to the Absolute Monitoring Center from the device. If a device is offline when an event occurs, the event information isn't uploaded until the device comes back online. As a result, this value may differ from the value in the Date column.

  Reported date applies only to Freeze, File Delete, Run Script, Send Message, and Wipe events that occur on a device (for example, Device freeze removed, Script succeeded, and Delete file failed).

  About events with updated properties

  For events that show the properties that were updated, such as Disk updated, up to three properties are shown in the Summary area. If there are more properties, a More... link shows. To open a dialog showing the following information about each updated property, click a bolded property value, or click More...:

  Column	Description
  Property Name	The field or property that was updated.
  Old Value	The previous value associated with the item.
  New Value	The new value associated with the item.

  Example

  A Device location updated event is logged. Clicking the place name opens a pop-up dialog showing old and new values for Longitude, Latitude, Quality (accuracy in meters), Country, State, and City.

Events are retained in the database for 30, 90, or 365 days, depending on the event type. For example, session timeout events are retained for 30 days while cryptographic wipe completed events are retained for 365 days.

View the data retention period for each event type

Data retention periods conform to Absolute data processing policies and are subject to change without prior notice.

By default, the following filter is used to generate the Events page:

Date within last 7 Days

You can change the number of days in the Date filter.

Depending on the data retention periods of the displayed events, setting the Date filter to a value greater than 30 days may not generate additional results.

You can also click to filter events by:

• Device

  Begin entering the device's device name, serial number, or Absolute Identifier and then select the device from the selection list

• Event

  Select a condition and then select an event from the list of events

• User

  Begin entering the user's name, username, or user account status (Active, Suspended, or Temporarily Suspended) and then select the user from the selection list

To clear all filters that you've added, click > Reset to default.

Filtering "updated" events

You can filter "updated" events based on their old or new field values.

To filter "updated" events:

1. Click and click Select Field.

2. Search for one of the following events:

   • Device location updated
   • Device user information updated
   • Disk updated
   • Network adapter updated
   • Operating system updated
   • Role updated
   • Rule updated
   • Script updated
   • Smart device group updated
   • Static device group updated
   • System information updated
   • User updated
   • Volume updated
3. Click the icon next to the event and select a property to filter by.
4. Select a condition and then enter a field value.

Example

You want to find all Windows devices that have upgraded to the latest Windows update in the last 7 days. You add the following filter to the default view of the page: Operating system updated > Build is <Windows update build number>.

For more information about working with filters, see Editing report filters.

While you are viewing a page or report, its data is not updated dynamically as new data becomes available. To show the most recent data available in the system, such as information that was just uploaded from a device, click the icon in the bottom left of the page. The Last updated field updates to the current date and time.

You can click (Save as report) on the action toolbar to save the page as a new report. You can access your report in the My Reports view of the Reports page, or the Events report category. Any filter, column, and sort customizations that you added to the page are saved to the new report.

You can click (Export) to export the page as a report and download it to your computer. If you've edited the page's filters or added or removed columns, your changes are reflected in the exported report, even if you don't actively save your changes.

Before exporting the Events page, note the following:

• Changes to the page's default sort order are not exported.
• If there are multiple property changes associated with an event, each change shows on a separate row in the exported report.
• Depending on the total number of events included in your export, it may take a few minutes to export the report.
• If your account includes more than 20,000 devices, the Events page may contain hundreds of thousands of events. Filter the page to show the events of interest and then export it in CSV (.csv) format. Excel (.xlsx) format does not support extremely large reports (> 1 million rows).

The following columns are included in the exported report: