User gets action window, but I can't find any log or message regarding the detection.

I still have issues regarding the central management platform…
A user gets repeatedly warnings about a connection and has to select an action:

I asked the user to select block for now.

Question: Where can I see in the console what was going on and what the user action was?

As an ‘admin’ I want to see what triggered the connection and maybe I can whitelist or blacklist the cause.
But it’s nowhere to be found in the logs from the console. (besides logging in on the user’s device and open local logs)


Hi @ailan ,

I added screenshots from products. Also please check the help guides.
EM Portal

CCS Agent

Product Management Team.

Hi @zeynepyildirim,

Thanks for the links.

The only link what could be relevant was your second because the first is regarding configuring the firewall and the other 3 are from the user’s device.
So I doublechecked ‘‘Security Sub-Systems’ > ‘Security Dashboards’ > ‘Device View’’ and I have only 8 logentries today, but none from the user who mentioned the warning.

So the logs are not here.

Is there any other way to look the logs/warnings from the console and not from the user’s device?


I will direct our support team for investigation.

Product Management Team.

Hi @zeynepyildirim,
Please do. I think it’s a structural problem looking also at my earlier posts: