If an event subtype is highlighted, the event has other events associated with it. Clicking a highlighted event subtype brings you to an Install Event Details report, which shows all of the sub-events associated with the event you clicked (per computer).
The Install Event Details report is useful primarily to show the connections between a root event and the events it generates.
Note: Events generated by the root installation event are reported here, not files installed by an installer. Whether installation of a file generates an event depends on the approval status of the installer, and can also depend on the security policy of the computer where the files are being installed, and other rule and configuration settings that can exclude file tracking. Events include information such as process name and the user who is running the process.
Approved installers generate locally approved files, and approved files do not generate sub-events on the Install Event Details page. Unapproved installers generate unapproved files (unless previously approved by some other means), and unapproved files do generate sub-events. Newly installed files that are blocked generate Install Event Details.
