When building user dossiers, records of certain events that occurred over a certain threshold period are combined into a single event. This feature, known as event folding, optimizes the processing of event data and improves the accuracy of user dossiers. The threshold period is 10 seconds.

Given that a single user action often causes multiple events, DeviceLock applies event folding when processing events from the audit log. Events of the same type such as Access Allowed or Access Denied are combined into one event if all of the following conditions are met:

Event folding is performed when building any diagrams, charts, and lists on user cards.