Monitoring actions

The Actions page in the History area shows the actions that comprise a device action request, listed by device. By default, the page shows actions created within the past 30 days, but you can update the page's filters to show up to five years of actions. You can also view an overview about the request an action belongs to.

Actions that belong to a request that is Done are available for two years.

Actions that belong to a request that is Pending Approval, Scheduled, or In Progress are available for five years.

To view or export the Actions page, your role needs to be granted the View permission for one of the supported actions. To view a particular action on the Actions page, your role needs to be granted the View permission for that action.

To open the Actions page, click History > Actions on the navigation bar.

The Actions page includes a default collection of action information organized in the following columns:

Column Description
Device name

Includes the device's device name The name assigned to the device in the operating system. For Chromebooks, device name is not applicable and therefore shows as "Chrome" in the Secure Endpoint Console. and serial number The identification number assigned to the device by the device manufacturer. For Windows devices, this value may correspond to the serial number of the BIOS, the motherboard, or the chassis, depending on the manufacturer.

To view the device's Device Details page, click the linked device name.
Request The request name and request ID
Action > Status

The progress of the action on the device and the date of the last status update (as a relative date, such as 23 days ago)

Hover over the relative date to view the exact date and time in a tooltip.

Action status can be one of the following:

  • Failed: either the system or the device is unable to perform the action, the request was declined, or the request was auto declined

    Add the Action > Status details column to see the reason for the failure.

  • Pending: the action hasn't been downloaded to the device or the request requires approval
  • Ready (Send Message and Scheduled Freeze requests only): the action has been downloaded to the device, but is scheduled to take place in the future
  • Canceled: a user has canceled the action
  • Processing: the action is currently being performed on the device but the action hasn't yet been completed

  • Succeeded: the action has run on the device and the action was completed successfully

    • Cryptographic Wipe
    • Run Script

  • Completed: the action has run on the device

    • Delete File

      For Delete File requests, review the Output column, the Log file, or Events to determine if the action was successful.

      When a Delete File request runs on a device, the files found and the files deleted may not be the same. The Output column and Events show the number of files found and the number of files deleted. The Log file contains further details about which files were found and which files were deleted, as well as the reason files weren't deleted.

    • Freeze

      For Firmware Freeze requests, review the Action > Status details column to determine if the action was successful at both the OS and firmware levels.

      A Firmware Freeze request that couldn't be processed may temporarily show an action status of Completed before the status is updated to Failed.

    • Remove Freeze
    • Run Playbook
    • Send Message
    • Unenroll
Type

The type of request the action belongs to

Possible values are:
Output

The output, if any, of the action

  • Cryptographic Wipe: a link to download the Certificate of Sanitization

  • Delete File - Delete Files: Found n – Deleted m

    The number of files found on the device (n) and the number of files deleted (m)

    If the number of files found is different than the number of files deleted, see the log file for detailed information.

    Click Log file to download the log file.

  • Delete File - Delete All Files: a link to download the Certificate of Sanitization and the log file

    Click Certificate to download the Certificate of Sanitization.

    Click Log file to download the log file.

  • Freeze: the masked unfreeze code A 4 to 8 digit passcode that a user can enter on a frozen device to unfreeze it.

    For security reasons, the unfreeze code is masked. To show it, click (Show). An Unfreeze code unmasked event is logged to Event History. To hide it again, click (Hide).

  • Run Script: the script return code used to inform the user whether the request was successfully run

    The script returns 0 if the script is a success. The other return codes are defined in the script.

  • Send Message: the message response

    A semi-colon (;) delimited list of Field Names and values for the Custom Device Fields included in the response to the message

    Format: Field Name 1: value 1; Field Name 2; value 2

    Shows No Data when:

    • The message requires a user response but a response hasn't been received
    • The message was informative and Custom Device Fields were only used to share information or weren't used at all

    Hover over the field to see a tooltip to see all values or click in the row to see a request overview.
Requester

One of the following:

  • The full name and email address of the user that created the request

    If your role is granted the View permission for Users, click the name to view user details. If your role is granted the Manage permission for Users, click the name to view or edit user details.

  • The name of the triggered Action rule that created the request

    If your role is granted the View permission for Rules, click the name to view rule details.

If the user or rule is now deleted, its name is not clickable.
Created date The date and time the action was created
Action > Status updated The date and time the status was last updated
OS name The name of the operating system detected on the device

You can include additional information on the page by adding more columns.

By default, the following permanent filters are used to generate the Actions page:

  • Created date within the last 30 days

    You can change the number of days in the Created date filter.

  • Type is Any: shows all supported action types

    You can edit this quick filter to select one or more action types.

  • Status is Any: shows all action statuses

    You can edit this quick filter to select one or more action statuses.

  • Device is Any: shows all devices

    To filter for devices, enter the search criteria and select the devices from the Results. Up to ten devices that match your search criteria are listed under Results. You can search by any of the following:

    • Device name

    • Serial number

    • Username

    • Chromebook Annotated ID

    • Identifier

You can also click to add additional filters.

You can't filter using the Output column. You can add the Message name and Script name columns and add them as filters.

The name of the End User Message wasn't recorded for Send Message requests that were created prior to Secure Endpoint 9.0 (April 2024). As a result, you can't use the Message name filter for these requests.

To view information about the request an action belongs to, click anywhere in the action background to open the request overview.

While you are viewing a page or report, its data is not updated dynamically as new data becomes available. To show the most recent data available in the system, such as information that was just uploaded from a device, click the icon in the bottom left of the page. The Last updated field updates to the current date and time.

You can click (Save as report) on the action toolbar to save the page as a new report. You can access your report in the My Reports view of the Reports page, or the Security report category. Any filter, column, and sort customizations that you added to the page are saved to the new report.

You can click (Export) to export the page as a report and download it to your computer. If you've edited the page's filters or added or removed columns, your changes are reflected in the exported report.

When you export the information from Actions:

  • Device name is exported as the following columns: Identifier, Device name, and Serial number.
  • Request is exported as a Request name column and a Request ID column.
  • Output is exported as the following columns: Unfreeze code, Result, Message response, and Script return code.
  • Requester is exported as a Requester name column and a Requester email column.

Depending on the Absolute licenses associated with your account, and your user role, you may be able to perform some or all of the following tasks from the Actions page: