Application Control specific events with the name, event ID, severity, and the description are described in this table.
Event names with a suffix (_UPDATE) indicate that events are generated in Update mode.
Event ID (on systems) | Threat event ID (on ePO - On-prem) | Event name | Severity | Description |
|---|---|---|---|---|
1 | 20700 | BOOTING_DISABLED | Warning | Trellix Solidifier is currently disabled. |
4 | 20703 | ENABLED_DEFERRED | Info | Trellix Solidifier will be enabled on service restart. |
5 | 20704 | DISABLED_DEFERRED | Warning | Trellix Solidifier will be disabled on the next reboot. |
6 | 20705 | BEGIN_UPDATE | Info | Trellix Solidifier is starting update mode on the system to allow updates. |
7 | 20706 | END_UPDATE | Info | Trellix Solidifier is ending update mode on the system. |
8 | 20707 | COMMAND_EXECUTED | Info | sadmin command executed. |
20 | 20719 | WRITE_DENIED | Major | Trellix Solidifier prevented an attempt to modify file '<string>' by process <string> (Process Id: %u, User: <string>). |
21 | 20720 | EXECUTION_DENIED | Major | Trellix Solidifier prevented unauthorized execution of '<string>' by process <string> (Process Id: %u, User: <string>). |
41 | 20740 | FILE_ATTR_SET | Info | Trellix Solidifier detected addition of attribute '<string>' to file '<string>' by program <string> (User: <string>). |
43 | 20742 | FILE_ATTR_SET_UPDATE | Info | Trellix Solidifier detected addition of attribute '<string>' to file '<string>' by program <string> (User: <string>, Workflow Id: <string>). |
62 | 20761 | INVENTORY_CORRUPT | Critical | Trellix Solidifier detected that its internal inventory for the volume is corrupt. To rectify this, please delete the inventory and solidify the volume again. |
70 | 20769 | FILE_CREATED | Info | Trellix Solidifier detected creation of '<string>' by program <string> (User: <string>, Original User: <string>). |
71 | 20770 | FILE_DELETED | Info | Trellix Solidifier detected deletion of '<string>' by program <string> (User: <string>). |
72 | 20771 | FILE_MODIFIED | Info | Trellix Solidifier detected modification to '<string>' by program <string> (User: <string>). |
73 | 20772 | FILE_ATTR_MODIFIED | Info | Trellix Solidifier detected modification of attributes of '<string>' by program <string> (User: <string>, Original User: <string>, Workflow Id: <string>). |
74 | 20773 | FILE_RENAMED | Info | Trellix Solidifier detected renaming of '<string>' to '<string>' by program <string> (User: <string>). |
75 | 20774 | FILE_CREATED_UPDATE | Info | Trellix Solidifier detected creation of '<string>' by program <string> (User: <string>, Workflow Id: <string>). |
76 | 20775 | FILE_DELETED_UPDATE | Info | Trellix Solidifier detected deletion of '<string>' by program <string> (User: <string>, Workflow Id: <string>). |
77 | 20776 | FILE_MODIFIED_UPDATE | Info | Trellix Solidifier detected modification of '<string>' by program <string> (User: <string>, Workflow Id: <string>). |
78 | 20777 | FILE_ATTR_MODIFIED_UPDATE | Info | Trellix Solidifier detected modification of attributes of '<string>' by program <string> (User: <string>, Original User: <string>, Workflow Id: <string>). |
79 | 20778 | FILE_RENAMED_UPDATE | Info | Trellix Solidifier detected renaming of '<string>' to '<string>' by program <string> (User: <string>, Workflow Id: <string>). |
80 | 20779 | FILE_SOLIDIFIED | Info | '<string>' was solidified which was created by program <string> (User: <string>, Workflow Id: <string>). |
82 | 20781 | FILE_UNSOLIDIFIED | Major | '<string>' was unsolidified which was deleted by program <string> (User: <string>, Workflow Id: <string>). |
84 | 20783 | ACL_MODIFIED | Info | Trellix Solidifier detected modification to ACL of '<string>' by program <string> (User: <string>). |
85 | 20784 | ACL_MODIFIED_UPDATE | Info | Trellix Solidifier detected modification to ACL of '<string>' by program <string> (User: <string>, Workflow Id: <string>). |
86 | 20785 | PROCESS_STARTED | Info | Trellix Solidifier detected start of process: '<string>' (Process Id: <string>, User: <string>, Original User: <string>) by process: '<string>' (Process Id: <string>). |
87 | 20786 | PROCESS_EXITED | Info | Trellix Solidifier detected exit of process: '<string>' (Process Id: <string>, User: <string>) by process: '<string>' (Process Id: <string>). |
88 | 20787 | TRIAL_EXPIRED | Major | Trellix Solidifier will be disable on the next reboot as its trial period has expired. |
89 | 20788 | READ_DENIED | Major | Trellix Solidifier prevented an attempt to read file '<string>' by process <string> (Process Id: <string>, User: <string>). |
102 | 20801 | UPDATE_MODE_DEFERRED | Info | Trellix Solidifier will be in update mode on service restart. |
103 | 20802 | FILE_READ_UPDATE | Info | Trellix Solidifier detected read for '<string>' by program <string> (User: <string>, Original User: <string>, Workflow Id: <string>). |
120 | 20819 | BEGIN_OBSERVE | Info | Trellix Solidifier is currently in observation mode. |
121 | 20820 | BEGIN_OBSERVE_DEFERRED | Info | Trellix Solidifier will be in Observation mode on service restart. |
122 | 20821 | END_OBSERVE | Info | Trellix Solidifier is ending observation mode on the system. |
123 | 20822 | END_OBSERVE_DEFERRED | Info | Trellix Solidifier will end observation mode on the next reboot. |
124 | 20823 | INITIAL_SCAN_TASK_COMPLETED | Info | Trellix Application Control Initial Scan task is complete and Application Control is enforced on the system now. |
NA | - | ALERT_CACHE_OVERFLOW | Major | Event Cache Watermark Overflowed. |
NA | - | ALERT_CACHE_WM_BREACHED | Warning | Event Cache Watermark Breached. |
NA | - | ALERT_CACHE_WM_RECOVERED | Info | Event Cache Watermark Recovered. |