Configure BAC 2.x Web Reports and Blocked Event Collection

Activate the three BAC 2.x reporting Analyses (304, 305, 306) and deploy Task 365 to your target endpoints so that policy inventory, certificate health, and blocked execution events are visible in BigFix Web Reports. Without these Analyses active, policy and block event data will not appear in Web Reports regardless of whether policies are deployed.

Before you begin

  • Complete computer subscription before activating Analyses. See Subscribe Target Computers to the BAC Site.
  • Confirm that BigFix Web Reports is accessible and configured for your environment. Analysis data is only surfaced in Web Reports — it does not appear in the BigFix Console content panels.
  • You must have sufficient operator permissions in the BigFix Console to activate Analyses and deploy Tasks to target computers.

Procedure

Part 1: Activate reporting Analyses
  1. In the BigFix Console, navigate to the BigFix Application Control site content and select Analyses.
  2. Activate each of the following three Analyses:
    1. Activate Analysis 304 – Policy and Rule Inventory v2.x to track deployed policy definitions, versions, and statuses.
    2. Activate Analysis 305 – Certificate Monitor v2.x to monitor signing certificate expiration and thumbprint validity.
    3. Activate Analysis 306 – Blocked Events v2.x to parse and report Code Integrity and AppLocker block events from subscribed endpoints.
    These Analyses collect policy versions, certificate validity, and block event data from subscribed endpoints and surface the results in BigFix Web Reports. Activate all three — each covers a distinct reporting dimension.
Part 2: Deploy the blocked event collection Task
  1. Locate Task 365 – Generate WDAC Code Integrity and AppLocker Blocked Events in the BAC site content.
  2. Deploy Task 365 to the target endpoints on a recurring schedule aligned to your reporting cadence.
    Task 365 triggers client-side log processing that collects local Code Integrity and AppLocker block events and publishes them into BigFix Web Reports for Analysis 306 to surface. Without Task 365 running periodically, Analysis 306 data will not be current. Schedule Task 365 based on how frequently your security team reviews block event reports.

Results

Analyses 304, 305, and 306 are active and will begin collecting data from subscribed endpoints on their next evaluation cycle. Task 365 is deployed and will generate block event data on its configured schedule. To confirm, open BigFix Web Reports and verify that policy inventory and certificate entries appear under the BAC reporting views. Block event data will appear after Task 365 runs for the first time on target endpoints.

What to do next

Proceed to the end-to-end Task execution workflow to install and configure BAC infrastructure, author policies, and deploy compiled binaries to endpoints. See BAC 2.x Task Execution Workflow and Fixlet Reference.