About device control events

When a device control event occurs, for example, a removable storage device has been blocked, the event is sent to Sophos Enterprise Console and can be viewed in the Device Control - Event Viewer dialog box.

Note If you set optical disk drives to "Read only", events for these disk drives are not sent to Sophos Enterprise Console or logged locally. This prevents unwanted reports of events.

In the Device Control - Event Viewer dialog box, you can use filters to display only the events you are interested in. You can also export the list of device control events to a file. For details, see About device control events and Export the list of events to a file.

You can use device control events to add exemptions for specific devices or device models to the device control policies. For more information about exempting devices, see Exempt a device from a single policy or Exempt a device from all policies.

The number of computers with device control events over a specified threshold within the last seven days is displayed on the Dashboard. For information on how to set up the threshold, see Configure the Dashboard.

You can also set up alerts to be sent to your chosen recipients when a device control event has occurred. For details, see Set up device control alerts and messages.