Elevation events
Every elevation attempt becomes an event: who asked, on which device, for exactly which binary, what the platform thought of it, and what was decided. This page is the field reference for the Requests → Elevation queue and the event detail view.
Where requests come from
The agent creates the event the moment a user attempts elevation, so the tray can poll for status. The event only appears in the admin queue once the user submits a justification: placeholder rows a user abandoned are hidden from approvers, so nobody can approve a request that was never consciously made.
Statuses
See Control modes for the full status table with colors. In short: pending and awaiting second approval are live; approved, denied and blocked are decisions; dismissed, expired, cancelled and revoked are neutral closures.
Field reference
Requesting context
| Field | Meaning |
|---|
| user_name / user_sid | The requesting endpoint user. The SID keeps attribution stable across renames. |
| device / machine_id | The device the request came from, linked to its device page. |
| organization | Which client (MSP tier) the device belongs to. |
| reason | The user's typed justification. |
| agent_version | Agent build that produced the request, for field triage. |
Binary identity
| Field | Meaning |
|---|
| exe_path | Absolute path of the launched binary. |
| exe_hash | SHA-256 of the binary. The strongest identity anchor. |
| exe_product_name | Product name from the version resource ("Google Chrome"). |
| exe_original_filename | Original filename the vendor compiled in; survives renames on disk. |
| exe_file_version | File version from the version resource. |
| exe_file_description / exe_internal_name / exe_copyright | Remaining version-resource identity fields, useful for vendor-wide rules. |
| exe_size_bytes | File size, usable as a rule comparison. |
| exe_icon | The binary's embedded icon, extracted by the agent so approvers recognize the app at a glance. |
Publisher and signature
| Field | Meaning |
|---|
| publisher_name | Subject CN of the leaf signing certificate ("Mozilla Corporation"). |
| cert_thumbprint | Fingerprint of the exact signing certificate. |
| cert_subject_o / _ou / _c | Organization, Organizational Unit and Country from the subject DN. The O element powers vendor-wide rules across per-product CNs. |
| cert_issuer_cn | The CA that issued the signing certificate. |
| signature_status | VALID, UNSIGNED, INVALID, REVOKED, EXPIRED or UNKNOWN_CA. See status colors. |
Launch context
| Field | Meaning |
|---|
| cmdline_args | Arguments the binary was launched with. |
| working_dir | Working directory at launch. |
| parent_process / parent_process_hash | What spawned it. An installer launched by an unknown parent reads very differently from one launched by Explorer. |
Scoring
| Field | Meaning |
|---|
| amsi_result | The device's own antivirus verdict via AMSI. The agent blocks locally on a detection; a clean result is shown alongside cloud signals. |
| confidence | The unified confidence score and band. |
| AI analysis | Model-written summary with a legitimacy score and risk indicators. See Risk scoring. |
| ML score | Prediction from the scorer trained on your tenant's own decision history. |
Decision details
| Field | Meaning |
|---|
| approved_by / approved_at | Who decided and when. The approver's avatar is shown across queues and the dashboard. |
| second_approver | Required for global-scope approvals. |
| scope | one_time, session, machine, client or global. See the overview. |
| approval_justification / change_ticket / review_date | Governance fields; ticket and review date are mandatory at global scope. |
| approved_cmdline_regex / approved_working_dir | Optional runtime constraints the agent enforces on the elevated launch. |
| allow_child_processes / allow_shell_spawn | Whether the elevated process may spawn children or shells. Both default off; shells especially are a classic escalation path. |
| decision_channel | Where the decision was made: web, ios, agent or technician_session. |
| mfa_verified / auto_approved | Whether the user passed an MFA challenge, and whether a rule or ML auto-approval decided without a human. |
| execution_mode | admin, user or system; stamped into the signed approval so it cannot be swapped afterward. |
| elevated_at / elevation_result | When the agent actually elevated and how it went. |
USB exception requests ride the same queue with their own identity fields; see
USB control. Execution-audit observations from allowlisting are deliberately kept out of this queue; they live on their own
Execution events page.