---
title: Events
slug: admin/events
description: This document delves into the Secure Work from Home application, detailing a comprehensive list of events and their corresponding actions. From authentication failure to unauthorized process detection, it covers a broad range of potential scenarios. Event
icon: ✉️
createdAt: 2022-08-18T22:05:37.000Z
---

Events drive Secure Work from Home in terms of actions taken, supervisor feedback, and historical reporting and analysis.  As described earlier, Event Sources monitor the agent's environment according to the agent's assigned Feature Template and, if the appropriate situation is encountered, one of the appropriate Events below is generated and any Event Actions defined for that event are taken.  Note that the Secure Work from Home client application must be running for these events to be generated.

### AuthenticationFailureDetected

- Generated when initial face authentication fails.
- Feature Settings:  [Face Authentication](docId\:z3QoDWz1abHtUVlXTpXn2)
- Typical Event Actions:  insertToDB, lockScreen

### AuthenticationSucceeded

- Generated when initial face authentication succeeds. 
- Feature Settings:  [Face Authentication](docId\:z3QoDWz1abHtUVlXTpXn2)
- Typical Event Actions:  insertToDB

### AuthenticationFaceMismatch

- Generated when face authentication and background authentication both fail
- Feature Settings:  [Face Authentication](docId\:z3QoDWz1abHtUVlXTpXn2)
- Typical Event Actions:  insertToDB, lockScreen, 

### BackgroundAuthenticationFailureDetected

- Generated when on-going background face authentication fails.  
- Feature Settings:  [Face Authentication](docId\:z3QoDWz1abHtUVlXTpXn2)
- Typical Event Actions:  insertToDB, lockScreen

### BackgroundAuthenticationSucceeded

- Generated each time the on-going background face authentication succeeds.  
- Feature Settings:  [Face Authentication](docId\:z3QoDWz1abHtUVlXTpXn2)
- Typical Event Actions:  insertToDB

### BlacklistedKeyStrokeDetected

- Generated each time agent selects Ctrl-C (copy) or PrintScreen.
- Feature Settings:  [Computer Detection](docId\:UCHmaOmifJt8WjsHejExz)
- Typical Event Actions:  insertToDB

### CameraBlockDetected

- Generated when a USB camera is detached.
- No Feature Settings.  Always enabled.
- Typical Event Actions:  insertToDB

### ExternalMonitorDetected

- Generated when an external monitor is connected to the agent's system.
- Feature Settings:  [Computer Detection](docId\:UCHmaOmifJt8WjsHejExz)
- Typical Event Actions:  insertToDB

### GadgetDetected

- Generated when some or all of a gadget (e.g., a mobile phone) is detected within the camera's view.
- Feature Settings:  [Gadget Detection](docId\:dlZEBTp28z3lTN9K7UB1S)
- Typical Event Actions:  insertToDB, lockScreen

### LivenessFailureDetected

- Generated when the system detects that it is not looking at a live person's face (i.e., it is a picture).
- Feature Settings:  [Liveness Detection](docId\:MVXWg-LOG8Z7An9Q97wLa)
- Typical Event Actions:  insertToDB, lockScreen

### MultipleFaceDetected

- Generated when more than 1 face is detected in the camera's view.
- Feature Settings:  [Shoulder Surfing Detection](docId\:GVva2Hmnpx6OeOjygedNV)
- Typical Event Actions:  insertToDB, lockScreen

### NetworkConnectionDetected

- Generated whenever the agent's computer reconnects to the network after being disconnected.
- Feature Settings:  [Computer Detection](docId\:UCHmaOmifJt8WjsHejExz)
- Typical Event Actions:  insertToDB

### NetworkDisconnectionDetected

- Generated whenever the agent's computer disconnects from the network after being connected.
- Feature Settings:  [Computer Detection](docId\:UCHmaOmifJt8WjsHejExz)
- Typical Event Actions:  insertToDB

### NoFaceDetected

- Generated after a successful face authentication when no human face is detected in the camera's view.
- Feature Settings:  [Face Authentication](docId\:z3QoDWz1abHtUVlXTpXn2) (TRS NOFACE DETECTION ENABLED)
- Typical Event Actions:  insertToDB, lockScreen

### RemovableDriveDetected

- Generated when a removable storage device (e.g., USB drive, mobile phone in storage mode) is initial connected to an agent's system.
- Feature Settings:  [Computer Detection](docId\:UCHmaOmifJt8WjsHejExz) (TRS STORAGE DETECTION ENABLED)
- Typical Event Actions:  insertToDB

### SCREENBLOCK

- Generated when a supervisor raises a screen block on an agent.
- Feature Settings:  [Supervisor Settings](docId\:qTHTitDH2QxbrPvOkKGRo)
- Typical Event Actions:  insertToDB

### UnauthorizedProcessDetected

- Generated if an unauthorized process is detected (and killed) by the system.
- See Event Sources in [Remote Security Rules](docId\:mXQk0WMZ-IyE61wlIOE2h) and MONITORPROCESSES in [Event Sources](docId\:M7Mjn8SyLCnYpukJurcKB) -- processes to be killed are configured in "Blacklist"

### UNBLOCKSCREEN

- Generated when a supervisor raises a screen unblock for an agent.
- Feature Settings:  [Supervisor Settings](docId\:qTHTitDH2QxbrPvOkKGRo)
- Typical Event Actions:  insertToDB

### Person Detection