Agent Audit Log "Start" event

[sghelpdesk]

Hi,

I cannot find a single "Start" event under my Agent Audit Logs. If I can see there is a "Start" if I use "Sub-Type" as a filter so I suppose there must be "Start" event. Does anyone have idea?

[Arman_Zaheri]

Hi,

I had a similar problem. I wanted to know when a client comes back online, but I couldn't find any useful event like "Start" under "Agent Logs". So I found a workaround and regularly checked agent's "Last Seen" using a Correlation Rule. Here's the post: Solved: LIVEcommunity - Re: Creating an Alert when a lost Endpoint device comes back online - LIVEco...