Reference Guide

Navigate the Dell Server
108
Audit Event - Column options Description
Login
If a user logged in and did a fast user switch, for example, logged in and then rebooted.
Logout
User logged out of a session.
Blocked PrintScreen
(Windows only and Data Guardian v2.7 and
earlier)
Indicates a file where a user tried to capture a screen while a protected Office document was open
and is blocked.
Blocked Process
(Windows only and Data Guardian v2.7 and
earlier)
When policy blocks a specified process executable, indicates a file where a user tried to run that
process executable.
Process Name
(Windows only and Data Guardian v2.7 and
earlier)
The name of the process that was blocked, for example, Snipping Tool.
Process Disposition
(Wi
ndows only and Data Guardian v2.7 and
earlier)
Indicates whether the process has exited or has been terminated.
Column options for Beacon only (protected Office documents)
Audit Event - Column options Description
Column options related to geolocation:
IP
Address
Routable
Geo Type
Latitude
Longitude
IP Address - When a Beacon event comes in and the Beacon server can determine the location of the
event, it lists the IP address.
Routable - True or False
• If True, geolocation data exists for that IP address and identifies the device's latitude and
longitude based on each operating system's APIs.
Note: If the Routable column lists True, but no geolocation data displays, an error occurred.
• If False, the IP address is non-routable.
Latitude and longitude - The data visualization is based on these coordinates rather than a street
address. Usually, the map visualization displays the location of the device. If a user accesses the
computer remotely and neither GPS or WiFi is available, the map visualization may display the
location based on the remote computer's VPN IP address. The column lists the coordinates as plus (+)
or minus (-), correlating to North, South, East, or West.
Geo Type - Typically, this is Point.
Geolocation for audit events is supported on Windows 8.1 and higher
Column options for Cloud Encryption only (mobile and web portal; Windows Data Guardian v2.3
and earlier; Mac)
Greyed out options indicate earlier versions of Windows and Mac Data Guardian. See also
Column_options_for_all_audit_events
.
Audit Event - Column options Description
Provider
Cloud storage provider. (Used for earlier versions.)
Cloud Name
Cloud storage provider name. See also File_Name.
Cloud Action
If a service acts on a .xen file, the Cloud Action column lists the reason. See
Cloud_Encryption_audit
events.
Process
Application
Process - Migration of Cloud Encryption events. A system event from the client performs an action on
the .xen file.
Application - App indicates this is part of the Cloud Encryption application.
Column options related to folder management
(Windows only with Data Guardian v2.3 and
earlier):
Folder Path
Folder Protection
If the Folder Management Enabled policy in Data Guardian > Cloud Encryption is enabled for an
endpoint, a user can select the Data Guardian icon in the endpoint's notification area, select Manage
Folders, and manually protect or unprotect a sync client folder. Typically, this policy is enabled for a
manager on a temporary basis.
This audit event allows you to monitor overrides to protected folders and investigate if files that need