Security Event States

Introduction

This page is the single reference for every state a security event can be in — what it means, when it occurs, and which actions are available from it. For the full narrative of how an event moves between these states, see Event Processing and Actions Available.

State reference

State	Tab	Description	When it occurs	Status	Available actions
Threat Assessment	Active	Application Fingerprinting (AFP) is evaluating the event against known safe behavioral patterns. Timer running. No lockout. Reached via the Active tab's Show Events in Assessment filter (off by default) rather than the State filter — see Monitor and Warning below. Replaces the 2.14 Pending Events tab.	Immediately after Signal Strength crosses the Warning threshold, before AFP has classified the event.	Current	Comment
Known Behavior	History	AFP matched a known safe pattern and suppressed the event automatically. No lockout, no alert. Full event detail preserved for audit.	Automatically, when AFP's confidence score exceeds the configured threshold.	Current	Comment
Monitor	Active	Selectable alongside Warning in the Active tab's State filter — see Monitor and Warning below.	Same triggering conditions as Warning.	Current	Acknowledge, Lockout Now, Comment
Warning	Active	Active event at Warning severity. No lockout. Auto-close timer running.	Signal Strength crosses the Warning threshold and AFP does not suppress it.	Current	Acknowledge, Lockout Now, Comment
Delayed Lockout	Active	Lockout countdown running. Administrators have a window to intervene before lockout applies automatically.	Signal Strength crosses the Major threshold.	Current	Stop Lockout Timer, Lockout Now, Comment
Locking	Active	Brief transient state while the system revokes the user's access — see Locking state below.	Automatically, as soon as a lockout is triggered (Critical severity, a Delayed Lockout timer expiring, or Lockout Now) and before access has been fully revoked.	Current	Comment
Lockout	Active	User access revoked immediately. Snapshots taken.	Signal Strength crosses the Critical threshold, a Delayed Lockout timer expires, or an admin manually locks out a Monitor/Delayed Lockout event.	Current	Restore User Access, Comment
Restoring	Active	Brief transient state while the system re-applies the user's access — see Restoring state below.	Automatically, immediately after Restore User Access is used on a Lockout event, before access has been fully re-applied.	Current	None — automatic transition state.
Acknowledged	Active	An administrator has reviewed the event but has not yet closed it.	Manually, or automatically when Stop Lockout Timer is used on a Delayed Lockout event.	Current	Close Event, Comment
Restored Access	Active	User access has been restored. The event awaits final classification.	After Restore User Access is used on a locked-out event.	Current	Close Event, Comment
Not a Threat	History	Event investigated and confirmed as unexpected but not a threat — see Unexpected but Not a Threat.	Manually, via the Close Event wizard.	Current	Comment
False Positive	History	Event closed as not malicious; feeds Application Fingerprinting and Learned Thresholds — see False Positive.	Manually via the Close Event wizard, or automatically when a Warning-severity event's expiry timer runs out with Learning Mode enabled.	Current	Comment
Threat Confirmed	History	Investigation confirmed a genuine threat — see Close as Threat.	Manually, via the Close Event wizard.	Current	Comment
Unresolved	History	Event timed out before being reviewed; not a judgment on whether it was a threat.	Automatically, when a Warning-severity event's expiry timer runs out with Learning Mode disabled.	Current	Comment
Recovered	History	The event's affected data was marked recovered via Mark as Recovered, without running it through Recovery Manager. Currently set by Security Guard on its own events, and available on a historical event — not a general closing outcome for standard active threat events.	Manually, via Mark as Recovered — see Actions menu reference.	Current	Comment
Self Recovery	—	A distinct workflow letting the end user recover their own affected files.	—	No longer available — not present in the current interface. Administrator-driven recovery is handled through Recovery Manager instead.	—
Error	Active, History	A distinct state reached when Eyeglass attempted an action on the administrator's behalf but the action failed.	When an administrator-initiated action fails to complete.	Current	Comment

Locking state

Locking sits between a lockout being triggered and the user's access actually being revoked. It's its own selectable state in the 2.15.0 GUI's State filter (Threat Detections → Active), separate from Delayed Lockout and Lockout. Comment is available from this state.

Restoring state

Restoring sits between Restore User Access being used and the user's access actually being re-applied. It's its own selectable state in the 2.15.0 GUI's State filter, separate from Lockout and Restored Access. As a brief, automatic transition state, it has no available actions — the event moves on to Restored Access on its own.

Monitor and Warning

The Active tab's State filter offers Monitor and Warning as two separate, independently selectable values. Both share the same underlying behavior — no lockout, auto-close timer running — and the same available actions; Monitor and Warning simply reflect the same low-severity active-event state under its current and legacy names.

Threat Assessment is reached separately: the Active tab has a distinct Show Events in Assessment filter (not part of the nine-value State filter) that is off by default — turn it on to see events still being evaluated by Application Fingerprinting. This replaces the 2.14 Pending Events tab; the underlying AFP evaluation itself hasn't changed, only where these events are surfaced.

Note: Signal Strength in the current interface surfaces a single accumulated score with a visual bar. The underlying event data model still tracks per-severity peak counts internally — the Zero Trust webhook payload for an event (see Webhook Configuration — Payload) includes peakMonitor, peakWarning, peakMajor, and peakCritical fields alongside the current signalStrengths breakdown, and a real LOCKED_OUT webhook sample confirms Create Snapshot is available as a general action from the locked-out state.

See also

• Event Processing and Actions Available — Full event lifecycle narrative and the Actions menu reference.
• Closing Event — The five closing states and the Close Event wizard.
• Recovery — Administrator-driven data recovery workflow.
• Detection Types — Threat detector categories (TD1–TD18), distinct from event states.
• Threat Detections — Overview — Terminology and the severity-by-severity triage workflow.