Skip to main content

​
How elevation events work

Elevation events are collected only when EPM is enabled, and the EPM control mode for the workstation is set to audit or rules.
  • Events are captured on Windows and macOS workstations when applications need to launch with administrative privileges or user needs to take a privileged action.
  • On windows idemeum agent intercepts and captures the UAC event. For macOS we rely on endpoint security API to capture the elevation event.
  • For audit mode elevation events are captured for both admin and standard users
  • Idemeum cloud retains 120 days of elevation events per tenant
  • Elevations events are uploaded to cloud in real time

​
Elevation event structure

To access elevation events navigate to your admin portal and access Activity → Events. You will be presented with the high level view of all events for your tenant. You can click on each event to expand the metadata for the event. Clean Shot 2026 05 25 At 11 04 27@2x Now let’s look at what each attribute in the event means.
ValueExampleDescription
Timestamp1/30/26 3:33:52 PMDate and time for when the execution or elevation happened.
ComputerAL-W11-LWorkstation that generated the event. Next to the computer name you will see the icon for Windows or macOS.
UserSYSTEMUser under which context the application is executing.
Filenameupdater.exeFilename of the executed application.
ElevationAllow, Deny, AuditTag that shows whether the application was allowed to elevate or not. For standard non-admin executions this tag is not shown. Audit represents the device that is in audit mode and not enforcing any rules.
ConfidenceSoft allowIdemeum confidence score that shows how safe the application is in your environment. We use 20+ behavioral attributes to calculate the score. Learn more here.
ReputationKnown good, Unknown, MalwareReputation of the file obtained from Sophos Intelligence cloud. Learn more here.
PublisherGoogle LLCOrganization that signed the executable. If you expand the event, you will be able to see whether the publisher is verified by operating system or not.
Parentconsent.exeParent process that was responsible for launching the executable.
Actions...Actions that you can take on the event, including rule creation.
DescriptionGoogle updaterDescription of the executable file.
File pathC:/program...File path from where the executable is launching.
File version2.5.1File version of the executable.
SHA256 hash320F6790E928200...Hash of the executable file takes with SHA256 algorithm.
Verified publisherYesIf the executable is legitimately signed with the certificate, and that certificate is trusted on the endpoint, the publisher will show as verified.
Certificate thumbprint607A3EDAA64933...Hash of the certificate that is used to sign the executable (if executable is signed).
Certificate elementsCN=Google LLC,OU=Google...When you expand the event, idemeum shows you the elements of the certificate that is used to sign the executable, such as CN, OU, C, etc.