It would be helpful if you could see the device associated with unsigned file events or unapproved certificate events when in those views. Sometimes the file path shows a username, but it's not enough to confirm where the event was detected. I believe this would be very useful for ESPM.