> ## Documentation Index
> Fetch the complete documentation index at: https://syteca.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# How to investigate and remediate event-based risks

> Investigate event-based risk factors, identify the activities or events that triggered them, and implement corrective actions to eliminate their root cause and reduce the likelihood of recurrence.

## Understanding Event-Based Risk Factors

Unlike state-based risk factors, which are triggered by a specific configuration state (such as a disabled firewall, missing updates, or disabled encryption), event-based risk factors are triggered by activities or events occurring on an endpoint.

Examples include:

* Processes without trusted signatures
* Excessive resource consumption
* Disk I/O errors
* Risky Windows event log entries
* USB device usage
* AI tool access

As a result, event-based risk factors often require additional investigation to understand:

* What event triggered the risk
* Why the event occurred
* Whether the event represents a legitimate concern
* What actions should be taken to prevent it from happening again

Unlike state-based risks, event-based risks are often unique to a particular endpoint, user, workload, or business process.

## Important Notes About Event-Based Risks

Event-based risk factors automatically change to the **No Longer Relevant** status at midnight according to the endpoint's local time zone.

This behavior is intentional and ensures that isolated events or temporary conditions do not permanently affect endpoint health scores.

Keep in mind that:

* The event context is cleared when the risk factor resets.
* Historical technical details may no longer be available after the reset occurs.
* Investigation should therefore be performed as soon as possible after the risk factor becomes active.

Additionally, even if the root cause is eliminated immediately, the risk factor typically remains **Active** until the end of the endpoint's calendar day and continues to affect endpoint health until the reset occurs.

## Procedure

1. Open the  [Endpoint details](/docs/espm/endpoints/endpoint-details) page for the affected endpoint.
2. Navigate to the **Risk Factors** grid.
3. Locate the event-based risk factor you want to investigate.
4. Expand the risk factor to review its technical details.
5. Analyze the available information to determine which events contributed to the risk score.

### Understanding Technical Details

The technical details often provide crucial information about the events that triggered the risk factor.

Examples may include:

* Process names
* Executable paths
* User accounts
* Event identifiers
* Device information
* Activity timestamps

Please note that technical details vary depending on the risk factor type.

For example:

* For process-related risk factors, such as **Processes Without Trusted Signatures**, only unique events are recorded.
* For Windows Event Log-related risks, such as **Disk I/O Errors**, only the first detected event may be recorded in the technical details.

As a result, the information displayed may represent only a subset of the events contributing to the risk score.

6. If additional analysis is required, investigate the endpoint directly to understand the activities, applications, or user actions associated with the event.
7. For deeper troubleshooting, enable **Debug** logging for the endpoint.
8. Collect and download the endpoint logs.
9. Review the logs to obtain additional information about the events that triggered the risk factor.

<Note>
  Debug logs often contain valuable information that is not visible in the Risk Factors grid and can significantly simplify root cause analysis.
</Note>

10. Once the cause of the risk has been identified, eliminate or remediate the underlying issue.
11. Review the **Recommendations** section of the risk factor and implement the suggested preventive measures.
12. Educate affected users, where appropriate, to reduce the likelihood of similar events occurring in the future.

## Key Considerations

* Event-based risk factors often require more investigation than state-based risk factors.

## Related

<CardGroup cols={2}>
  <Card title="About risk factors and probes" icon="book-alert" href="/docs/espm/about-risk-factors">
    Understand how risk factors and probes are evaluated on endpoints.
  </Card>

  <Card title="How to investigate risk factors" icon="workflow" href="/docs/espm/howto/how-to-understand-risk-root-cause">
    Investigate risk factors affecting an endpoint, review available technical details, and understand the underlying conditions or activities that caused a risk to be detected.
  </Card>
</CardGroup>

***

## title: "how-to-remediate-event-based-risk-factors"