About device control events

When a device control event occurs, for example, a removable storage device has been blocked, the event is sent to Sophos Enterprise Console and can be viewed in the Device Control - Event Viewer dialog box.

Note If you set optical disk drives to "Read only", events for these disk drives are not sent to Sophos Enterprise Console or logged locally. This prevents unwanted reports of events.

In the Device Control - Event Viewer dialog box, you can use filters to display only the events you are interested in. You can also export the list of device control events to a file.

You can use device control events to add exemptions for specific devices or device models to the device control policies.

The number of computers with device control events over a specified threshold within the last seven days is displayed on the Dashboard.

You can also set up alerts to be sent to your chosen recipients when a device control event has occurred.