The ExEvents view provides access to all events that are displayable on the Events page. This includes events related to files discovered, files blocked, files approved, unapproved files executed, system management processes, and actions by console users.
To see event data as it is displayed in the console, click Reports > Events in console menu to open the Events page.
Field Name |
Data Type |
Special Values |
Comments |
---|---|---|---|
|
bigint |
|
Primary Key |
|
int |
|
Foreign key into the ExComputers for computer that sent this event |
|
int |
|
Foreign key into the ExFileCatalog table for file associated with this event |
|
int |
|
Foreign key into ExFileCatalog table for a root file associated with this event |
|
nvarchar |
|
Name of the file related to this event |
|
nvarchar |
|
File path related to this event. Paths use the OS-specific delimiter for the agent on which the file is located. |
|
nvarchar |
|
Name of the process associated with this event |
|
int |
|
Foreign key into ExFileCatalog table for the process associated with this event |
|
datetime |
|
Date and time (UTC) this event was generated |
|
varchar |
|
IP address of the endpoint that originated this event |
|
nvarchar |
|
Event description |
|
nvarchar |
Debug, Info, Notice,Warning, Error, Critical |
Event priority |
|
nvarchar |
|
Event Type |
|
nvarchar |
|
Event Subtype |
|
nvarchar |
|
Name of the user associated with this event |
|
nvarchar |
|
Name of the Carbon Black App Control rule that caused the event (block/prompt/report/approval) |
|
nvarchar |
|
Name of the hash or filename ban associated with the event (empty if the ban was not named); introduced in 7.0.1 Patch 3 |
|
nvarchar |
|
If an updater is associated with the event, the name of the updater; introduced in 7.0.1 Patch 3 |
|
nvarchar |
|
If a threat indicator is associated with the event, the name of the indicator |
|
datetime |
|
Date and time (UTC) this event was received by the Carbon Black App Control Server |
|
nvarchar |
|
Command line for the process that attempted the action recorded by this event |