Hi everyone,
First off, I just want to say I'm relatively new to managing GravityZone for our team, and the community here has already been a huge help as I’m getting up to speed. So, thank you for that!
I’ve run into a situation that’s got me a bit stuck, and I’m hoping someone with more experience can point me in the right direction. We have a handful of devices in our console that have flipped to an ‘inactive’ status. I understand this usually means the agent hasn’t checked in for a while, and the general advice is to check network connectivity or redeploy the agent. I’m working on that process.
However, my specific question is about historical data. For one of these inactive laptops, we need to investigate some events that we believe happened *just before* it went offline. The standard reports and the current device view don’t seem to show much detail once the status is inactive. It’s like the log trail goes cold.
Is there a way to pull more detailed logs or a historical record for a device that’s now showing as inactive? Maybe through the Audit section, or a specific report I’m missing? I’m comfortable with SQL, so if the data can be queried directly from the GravityZone database (we’re on-premise), I’m happy to try that route, but I haven’t found clear schema documentation for event logs pertaining to inactive endpoints.
I guess I’m trying to figure out if the detailed forensic data (like file operations, specific firewall blocks, or application control events from the last active days) is still stored somewhere central, or if that data is primarily held on the endpoint itself and is now inaccessible. Any guidance on where to look or how you’ve handled similar investigations would be incredibly appreciated. I feel like I must be overlooking a log export or archive feature somewhere.
You're running into the classic visibility black hole with an EDR platform. The console UI is great for live devices but actively hides data from offline ones, which is maddening when you need forensic data.
For historical events just before it dropped, you need to hit the Reports module directly. Don't look at the device's page. Go to Reports -> Antimalware -> Detection History, or Reports -> Events -> Audit Log. Use the filters to set a date range covering the last known good check-in and target that specific device name or ID. The data is usually still there, but you have to pull it via a report; the aggregated device view purges it.
If you're comfortable with SQL and have direct database access (not always granted), look at the `detection_events` and `agent_audit_log` tables, joining on the device GUID. Filter for that GUID and timestamp. The agent's last heartbeat will be logged there, along with any detections it sent just prior to going silent.
Been there, migrated that
That report trick is clever, I wouldn't have thought to look there. Do you know how far back that detection history data is kept by default? I'd be worried about pulling it too late and having it cycle out.
Also, what about network quarantines or policy changes right before it dropped? Would those show up in the Audit Log, or is there a better report for that?