Logged events

• Agent self healing call If the Secure Endpoint Agent on a Windows device is damaged, tampered with, or removed, the Absolute Persistence module embedded in the device's firmware makes a self healing call to the Absolute Monitoring Center, which restores the agent.
• Agent status updated

  This event is typically preceded by the event that caused the agent status to be updated, such as Device enrolled, Device disabled, Refurbishment Processing, or Device unenrolled by refurbish partner.

• Device AV product changed
• Device became AV protected, unprotected

• App resilience policy activated, deactivated, changed

• App resilience device became compliant, noncompliant
• App resilience compliance reason updated
• App resilience remediated
• App resilience remediation failed

• API Token created, updated, deleted, expired

• User login and logout

• SSO enabled, disabled
• Two-Factor authentication enabled, disabled, reset

• Session timeout User sessions are terminated after 20 minutes of inactivity, at which time the user is redirected to the login page to log in again. This account-level setting is not configurable.

  This event is logged only when a user is redirected to the login page after their session times out after 20 minutes of inactivity. Other timeouts, such as closing the browser without logging out of the Secure Endpoint Console, are not logged.

• Session max time exceeded

  This event is logged if a user session is terminated because it exceeded the maximum duration of 12 hours.

• Service provider accessed

• Cryptographic wipe requested, completed, canceled, failed
• Cryptographic wipe cancellation requested, failed

• Custom Data field updated

• Custom field definition created, updated, deleted
• Custom field updated

• Device Compliance policy activated, deactivated, updated
• Device became compliant, non-compliant
• Device compliance reason updated

• Smart device group created, updated, deleted
• Static device group created, updated, deleted

• Volume added, removed

• Volume updated

  Properties

  Windows	Mac
  Volume ID Volume name Boot Compressed Drive letter File system Volume serial number Size bytes	Volume ID Volume name Boot Mount point File system Volume serial number Size bytes

• Device volume nearly full

  This event is logged when a volume's available space drops below 10%.

• Disk added, removed

• Disk updated

  Properties

  Windows	Mac
  Name Description Index Bytes per sector Firmware revision Manufacturer Media type Model Number of partitions Sectors per track Serial number Size bytes Status Total cylinders Total heads Total sectors Total tracks Total tracks per cylinder	Description Index Firmware revision Manufacturer Media type Model Size bytes

• Network adapter added, removed

• Network adapter updated

  Properties

  Windows	Mac
  ID IP V4 address IP V6 address IP subnet Default gateway DHCP enabled DHCP server	IP V4 Address Manufacturer

• Operating system updated

  Properties

  Windows	Mac
  Name Version Edition Build CSDVersion Product key Serial number	Name Edition Build

• System information updated

  Properties

  Windows	Mac
  System serial number System type System manufacturer System model Device name Full system name Public IP address Local IP address Public IPv6 address Local IPv6 address	Public IP address Boot device Name System directory System manufacturer System model Device name System type System serial number Time zone System integrity protection status

• Device user information updated

  Properties

  Windows and Mac
  Username Domain

• Action request pending approval
• Action request approved, declined, auto declined, canceled

• Device became Encrypted, Unencrypted
• Device Encryption product changed

• Playbooks policy activated, deactivated
• Playbook requested, completed, failed

• File delete requested, failed
• File deleted
• File delete cancellation requested, failed
• File delete canceled

• Device freeze requested, replaced, removed, removed by passcode, failed

• Scheduled freeze ready

  This event applies to Scheduled Freeze requests only.

• Device freeze cancellation requested

  This event is immediately followed by a Device freeze removed or a Remove freeze failed event.

• Device frozen timer expired

  This event applies to Scheduled Freeze requests only.

• Device frozen
• Firmware freeze succeeded, failed, removed by passcode

• Unfreeze code unmasked

  This event is logged when a user clicks the icon in the Unfreeze code column/field for a device.

• Remove freeze requested, failed
• Remove freeze requested for device

  This event is logged when a device passes the request's device eligibility check.

• Remove freeze failed for device

  This event is logged when a device fails the request's device eligibility check.

• Device freeze message template created, updated, deleted

• Device location updated

  Properties

  Windows and Mac
  Latitude Longitude Country code Country ID Country name State/Province State ID City City ID Technology For each secondary technology; <technology>.Latitude <technology>.Longitude

• Public IP location updated

  This event is logged only when the Geolocation setting is enabled and a Wi-Fi or OS Location is unavailable or invalid. Learn more

• Geolocation setting updated

• Geofence created, updated, deleted

• Device entered/exited a geofence

  • If a device changes its location by less than 100 meters, no event is logged.
  • For stolen devices, these events are not logged while the theft investigation is open.

• License assignment settings updated
• License updated on device
• Purchase order added, updated, expired

• Supervisor password created, updated, removed
• Supervisor password creation requested, failed
• Supervisor password update requested, failed
• Supervisor password remove requested, failed

Also see Refurbishment events.

• Policy group created, updated, deleted
• Device added to policy group

• Failed to add device to policy group

  This event is logged only when a device fails to move to the specified policy group when an Action rule is triggered.

• Script created, updated, deleted
• Script requested, succeeded, canceled, failed
• Script cancellation requested, succeeded, failed
• All pending scripts cancellation requested

• Refurbishment Blocked (applies to missing and stolen devices only)

• Refurbishment Processing, Failed

• Supervisor password creation request removed by refurbishment
• Supervisor password removal request removed by refurbishment
• Supervisor password update request removed by refurbishment

Also see Enroll and unenroll events.

• Device reported missing

• Missing device checked in, found

  This event is logged when a missing device is found or reported stolen.

• Theft report created, updated, reopened, closed

• Rule created, updated, deleted

  These events are not yet logged for Offline Freeze rules. See Offline Freeze rule events.

• Rule triggered

  For Location rules, if a device changes its location by less than 100 meters, no event is logged.

• End user message requested, completed, failed
• End user message cancellation requested, failed
• End user message canceled
• Message template created, updated, deleted

• Device enrolled

  Enrollment events show the enrolled device's Absolute Identifier only. Device name and serial number are not available.

• Device unenroll requested, failed
• Device disabled
• Device unenrolled by refurbish partner

• Missing device unenrolled by refurbish partner

  This event is no longer logged. In January 2025, it was replaced by the Refurbishment Blocked event.

Also see Refurbishment events.

• User created, updated, deleted
• Role created, updated, deleted
• Managed role added, removed
• Dual approval settings updated