This table provides a detailed list of all Change Control and Application Control events.
Event names with a suffix (_UPDATE) indicate that events are generated in Update mode.
In the Event type column, these abbreviations indicate the applicable type for the event.
SC — Solidcore client-related event
CC — Change Control event
AC — Application Control event
Event ID (on endpoints) | Threat event ID (on ePO - On-prem) | Event name | Event display string | Solidcore client severity | ePO - On-prem severity | Event type |
|---|---|---|---|---|---|---|
2 | 20701 | BOOTING_ENABLED | Booted in Enabled mode | Info | Information | SC |
4 | 20703 | ENABLED_DEFERRED | Enabled On Reboot | Info | Information | SC |
5 | 20704 | DISABLED_DEFERRED | Disabled On Reboot | Warning | Warning | SC |
6 | 20705 | BEGIN_UPDATE | Opened Update Mode | Info | Information | SC |
7 | 20706 | END_UPDATE | Closed Update Mode | Info | Information | SC |
8 | 20707 | COMMAND_EXECUTED | Command Executed | Info | Information | SC |
20 | 20719 | WRITE_DENIED | File Write Denied | Major | Error | CC |
21 | 20720 | EXECUTION_DENIED | Execution Denied | Major | Error | AC |
41 | 20740 | FILE_ATTR_SET | File Attribute Set | Info | Information | CC |
42 | 20741 | FILE_ATTR_CLEAR | File Attribute Cleared | Info | Information | CC |
43 | 20742 | FILE_ATTR_SET _UPDATE | File Attribute Set | Info | Information | CC |
44 | 20743 | FILE_ATTR_CLEAR _UPDATE | File Attribute Cleared | Info | Information | CC |
62 | 20761 | INVENTORY_CORRUPT | Inventory Corrupted | Critical | Critical | AC |
70 | 20769 | FILE_CREATED | File Created | Info | Information | CC |
71 | 20770 | FILE_DELETED | File Deleted | Info | Information | CC |
72 | 20771 | FILE_MODIFIED | File Modified | Info | Information | CC |
73 | 20772 | FILE_ATTR_MODIFIED | File Attribute Modified | Info | Information | CC |
74 | 20773 | FILE_RENAMED | File Renamed | Info | Information | CC |
75 | 20774 | FILE_CREATED _UPDATE | File Created | Info | Information | CC |
76 | 20775 | FILE_DELETED _UPDATE | File Deleted | Info | Information | CC |
77 | 20776 | FILE_MODIFIED _UPDATE | File Modified | Info | Information | CC |
78 | 20777 | FILE_ATTR_MODIFIED _UPDATE | File Attribute Modified | Info | Information | CC |
79 | 20778 | FILE_RENAMED _UPDATE | File Renamed | Info | Information | CC |
80 | 20779 | FILE_SOLIDIFIED | File Solidified | Info | Information | AC |
82 | 20781 | FILE_UNSOLIDIFIED | File Unsolidified | Info | Information | AC |
84 | 20783 | ACL_MODIFIED | File Acl Modified | Info | Information | CC |
85 | 20784 | ACL_MODIFIED_UPDATE | File Acl Modified | Info | Information | CC |
86 | 20785 | PROCESS_STARTED | Process Started | Info | Information | CC |
87 | 20786 | PROCESS_EXITED | Process Exited | Info | Information | CC |
88 | 20787 | TRIAL_EXPIRED | Trial license expired | Major | Error | SC |
89 | 20788 | READ_DENIED | File Read Denied | Major | Error | CC |
102 | 20801 | UPDATE_MODE _DEFERRED | Update Mode On Reboot | Info | Information | SC |
103 | 20802 | FILE_READ_UPDATE | File read in update mode | Info | Information | CC |
120 | 20819 | BEGIN_OBSERVE | Start Observe Mode | Info | Information | AC |
121 | 20820 | BEGIN_OBSERVE _DEFERRED | Start Observe Mode On Reboot | Info | Information | AC |
122 | 20821 | END_OBSERVE | End Observe Mode | Info | Information | AC |
123 | 20822 | END_OBSERVE _DEFERRED | End Observe Mode On Reboot | Info | Information | AC |
124 | 20823 | INITIAL_SCAN_TASK _COMPLETED | Initial Scan Completed | Info | Information | AC |
130 | 20829 | THROTTLING_ STARTED | Data Throttled | Major | Warning | SC |
131 | 20830 | THROTTLING_CACHE _FULL | Data Dropped | Major | Error | SC |