Can I create a report with "Device Control Event Viewer" results?

Hello renfrow,

you can export the data from the Event Viewer but AFAIK there is no report you could schedule - Alerts and Events does not include the user and Events by user display only counts.

Should be fairly easy to extract the information with the Sophos Reporting Interface. I've whipped up the following "bimodal" (:smileytongue::smileywink:) script as an example. Save it as whatevername.cmd or .bat , it writes to whatevername.txt in the same directory.

GOTO TheScript /*
:TheScript
@ECHO OFF
REM --- Select today and the last _int days (EventTime is UTC)
SET _int=7
REM --- change instance and databse name if necessary
SQLCMD -E -S .\SOPHOS -d SOPHOS521 -o %~n0.txt -u -i %~f0 -v Interval=%_int%
Exit /b 0
*/

TheScript:
DECLARE @Since INT = $(Interval)

SELECT 
  d.EventTime,
  c.Name AS ComputerName,
  d.UserName,
  d.ReportingName,
  d.DeviceTypeName,
  d.Model,
  d.DeviceID
  FROM [Sophos Reporting Interface].[vEventsDeviceControlData] AS d
    INNER JOIN dbo.ComputersAndDeletedComputers AS c 
          ON d.ComputerID = c.ID
          WHERE d.EventTime > DATEADD(DAY,-@Since,GETUTCDATE())
    ORDER BY SUBSTRING(d.UserName,CHARINDEX('\',d.USerName),256),
          d.UserName,
          d.EventTime

HTH

Christian

Thanks for this!