Query on Event ID 1035 - Cancelled Scan. What criteria constitutes a cancelled scan?
I'm trying to run a compliance report based off cancelled scans. I know that we can run a report off Event ID 1035 which indicates a scan was cancelled. Since this is an ePO managed scan, users do not have the ability to cancel a managed scan but they can defer it. Based off that scenario, what criteria would then constitute Event ID 1035 - Scan was cancelled?