To audit an event, you must first enable the event in Endpoint Management Console. You can enable the event at the zone or device level. An event that is enabled at the zone level applies to all devices in the zone, and an event that is enabled at the device level applies to only the selected device.
Log in to Endpoint Management Console.
(Zone) To enable events at the zone, click Configuration > Management Zone Settings > Audit Management.
or
(Devices) To enable events at the device, click Devices > Managed Devices. Locate the device in the Servers or Workstations folders, click the device object to display its properties, then click Settings > Audit Management.
Click Events Configuration to display the Events Configuration dialog page.
In the Change Events tab, click Add to display the Add Change Events dialog box.
For information about the change event categories, see Endpoint Management Audit Management Reference.
Expand the Change Events tree and select the required event.
Specify the following information for the Event Settings:
Event Classification: Based on the importance of the event, select Critical, Major, or Informational.
Days to Keep: Indicate the number of days to keep the event before purging it.
Click OK to add the event.
You can edit or delete an event by selecting the event in the Event Configuration page and clicking Edit or Delete from the menu bar. To select multiple events at a time, press Ctrl and click to select.