Agent Audit Log "Start" event

sghelpdesk — Wed, 26 Jun 2024 03:08:16 GMT

Hi,

I cannot find a single "Start" event under my Agent Audit Logs. If I can see there is a "Start" if I use "Sub-Type" as a filter so I suppose there must be "Start" event. Does anyone have idea?

Re: Agent Audit Log "Start" event

Arman_Zaheri — Wed, 26 Jun 2024 07:00:55 GMT

Hi,

I had a similar problem. I wanted to know when a client comes back online, but I couldn't find any useful event like "Start" under "Agent Logs". So I found a workaround and regularly checked agent's "Last Seen" using a Correlation Rule. Here's the post: Solved: LIVEcommunity - Re: Creating an Alert when a lost Endpoint device comes back online - LIVEcommunity - 577789 (paloaltonetworks.com)

topic Re: Agent Audit Log "Start" event in Cortex XDR Discussions

Agent Audit Log "Start" event

Re: Agent Audit Log "Start" event