Add Device Control Fields to CAP for reporting

Products Endpoint Protector Ideas
, , ,
1

Which aspect of EPP are you submitting for?

Endpoint Protector Server

What is a one sentence summary of your feature request?

Add Device Control Fields to CAP for reporting

Please describe your idea in detail. What is your problem, why do you feel this idea is the best solution, etc.

As an incident responder, i need to understand file movement so that I have the full picture of an event. Specifically, I would like to see the content of the Event column in Device Control logs replicated in CAP logs, allowing me to see information like File Copy, File Save, etc.

How do you currently solve the challenges you have by not having this feature?

today, we have to spend time aligning content aware and device control logs to see the full picture.

2 Likes
2

Hi Bree,

Thank you — this is a clear and well-framed request. Cross-referencing Device Control and Content Aware Protection logs to reconstruct a single event is a real overhead for incident response workflows, and surfacing the event type directly in CAP logs would meaningfully reduce that.

We’ve logged this as a feature request. We can’t commit to a timeline right now, but the use case is understood and it’s on our radar. We’ll update here soon as it progresses.