Insight not Reporting Application Manager Blocked Applications

Version 3

    Verified Product Versions

    Insight 10.0

    Insight will report applications that have been blocked by Application Manager. It does this by checking for 9000 events which it will then upload to the Insight Appliance.


    If you are using Application Manager to deny applications in "Audit Only" mode (which will only generate an event for the deny rather than actually blocking the application) you will not see these events when trying to create an Insight report. The "Audit Only" event will actually be uploaded to the Appliance but you cannot view them within the built in report functions.


    Insight will check each AM event that is uploaded for an "Is_Audit" parameter. If this parameter exists then this event is filtered out from the pool of events used for generating the blocked application report. This functionality is by design.