we are using an ArcSight Smart Connector to pull all interesting SEP event information into our ESM.
The Downloaded or created by field in SEPM is very interesting for our security analysts but it looks like the latest connector version 126.96.36.19958.0 does not support this kind of event information for SEP-DB Version 14.2.5569.2100.
Support says I should create an idea to let you guys know what our "problem" is. Maybe you have the same
issue and need a solution.