User gets action window, but I can't find any log or message regarding the detection.

I still have issues regarding the central management platform…
A user gets repeatedly warnings about a connection and has to select an action:

I asked the user to select block for now.

Question: Where can I see in the console what was going on and what the user action was?

As an ‘admin’ I want to see what triggered the connection and maybe I can whitelist or blacklist the cause.
But it’s nowhere to be found in the logs from the console. (besides logging in on the user’s device and open local logs)

1.png

Hi @ailan ,

I added screenshots from products. Also please check the help guides.
EM Portal

CCS Agent

Regards,
Product Management Team.

Hi @zeynepyildirim,

Thanks for the links.

The only link what could be relevant was your second because the first is regarding configuring the firewall and the other 3 are from the user’s device.
So I doublechecked ‘‘Security Sub-Systems’ > ‘Security Dashboards’ > ‘Device View’’ and I have only 8 logentries today, but none from the user who mentioned the warning.

So the logs are not here.

Is there any other way to look the logs/warnings from the console and not from the user’s device?

Hi

I will direct our support team for investigation.

Regards,
Product Management Team.

Hi @zeynepyildirim,
Please do. I think it’s a structural problem looking also at my earlier posts: https://forum.itarian.com/forum/products/endpoint-protection/40876-better-detailed-em-warnings-untraceable-warnings
Regards