Logging an event for ENS Administrator Logon

[Jmac24]

I thought there was a way that we could look up events in ePO showing when the ENS Administrator Logon password was used to unlock the ENS Console on a system. I can't find anything in ePO to query though. I do see an event logged in the EndpointSecurityPlatform_Activity.log showing this:

|Activity|MFEConsole |MFEConsole | 29464| 24444|PW |mfeux_extension.cpp(408) | Successful login attempt

Can someone point me to a way to query for that in ePO or know if it's possible? I definitely recall back to VSE seeing events for it in ePO but I am not seeing anything for ENS. Thanks.

[Jmac24]

I see a query for failed client interface attempts, but nothing for successful, and in the query criteria I'm not finding anything.