Filter tab

Filter incidents by the action (including those on endpoints) that was performed on the incident. Select the check box for each action to be displayed.

Incidents with the following actions can be displayed:

• Permitted
• Permitted (acknowledged)
• Blocked
• Attachment(s) dropped
• Quarantined
• Released
• Releasing
• Encrypted with profile key
• Encrypted with user password
• Denied (confirmed)
• Continued (confirmed)
• Forcepoint Email Security action
• File deleted
• Forcepoint CASB action
• Safely copied
• Quarantined with note
• Unshared all
• Unshared external and public file-sharing
• Monitor Mode

In addition to the default actions, DLP actions configured in the Forcepoint Security Manager are listed (Forcepoint Email Security and Forcepoint Data Security for Cloud Email only).

Limit which channels’ incidents are displayed in the report. The list of available channels depends on channels configured in the Security Manager.

If one or more email filters is selected, specify the email direction to display: inbound, outbound, or internal. Email direction is available only for those with the Forcepoint Email Security module, endpoint agent, or protector.

For the endpoint application filter, select the operations to display in the report. For example, choose Paste to display all endpoint incidents where users pasted sensitive data into a document.

It is also possible to view incidents from the Discovery channel or DLP Cloud Applications channels.

Select DLP Cloud Applications to view incidents detected when users uploaded, downloaded, or shared files with cloud applications such as Office365 or Box. (Enable the Cloud Applications service at Settings > General > Services.)

Display specific classifiers whose thresholds have been exceeded. For example, select a dictionary classifier with profanity in it, and set its threshold to 3. The report displays only incidents where more than 3 terms from this dictionary were detected.

Click Edit to add or remove content classifiers to the filter, then select a threshold for each.

Set the incident list to display only incidents that were directed at specific destinations.

Select Enable filter to select destinations from your resource list or enter them as free text. Choose which method you want to use from the drop- down list. If your free text includes a comma, enclose the value in quotes. For example: “Doe, John”.

If you have a role in which source and destination information is hidden for privacy reasons, this filter is not available.

Note that the filter returns values from all columns describing the destination, such as URL category, hostname, IP address, and domain.

Complex filters can affect performance.

See Selecting items to include or exclude in a policy for more details on using this selector.

Filter incidents by the date and time the policy engine first saw a transaction. An event is any transaction being analyzed. (An incident is an event that breaches policy.)

Select a date range, then select a time of day.

Date Range

• Last n days - Select this option to display incidents from the last n days, then select the number of interest. For example, display incidents from the last 30 days.
• Time period - Select this option to display incidents that transpired in a set period of time, then select the period. Example: last 24 hours, this week, or last month.
• Exact date and time - Select this option to display incidents that transpired during a time period that you define, then select the From and To dates and times from the drop-down lists.

For example, you can show incidents starting from 5:00 a.m. on April 1, 2009 to midnight April 30, 2009. Using the Time of Day options below this, you can specify whether to show all incidents from this period (Entire day) or just those from a time range, for example, 8 a.m. to 5 p.m. If you choose this From/To option, the report would include incidents from 8-5:00 on April 1, 8-5:00 on April 2, and 8-5:00 all other days of April, up to and including April 30.

Time of Day

By default, incidents are displayed no matter what time of day they occurred, as long as the date range matches. To display only those incidents that occurred at certain times of day, select From and choose a time range.

• Entire day - Select Entire day to show all incidents during the date range, no matter what time of day they took place.
• From ... to ... - Select this option to show only incidents from a specific period.

For example, if you select Last 60 days and From 8 a.m. to 5 p.m., the report displays all incidents from the last 60 days that were detected between 8 a.m. and 5 p.m.

If you prefer, you can view incidents that occurred during off-peak hours, such as 5 p.m. to 8 a.m. the next day. That way you know if information is being leaked at night when no one is around.

Filter using the name and size of the attachment or file.

You can select Any size to choose any file size or select a minimum or maximum file size using the At least and At most options.

You can choose to add or remove terms to be used as file names using the Include and Exclude options. You can enter the term (wildcards can be used), and click Add. You can use the Remove option to remove an item from the list. Continue until all required file names have been added.

• Marked by Microsoft Information Protection
• Protected by Microsoft Information Protection

Filter incidents by the date, administrator, or details contained on the incident History tab. For example, display all incidents that jdoe closed during March 2017.

• Select Filter by date to specify the date and time of the actions that were taken. Only actions during this period are included in the report. Select a date range and time of day.
• Select Filter by administrator to specify the administrator who performed the listed workflow action. Enter the administrator name or names. Separate multiple names by commas. For example: Type “jdoe, bsmith” to view incidents that jdoe and bsmith acted on.
• Select Filter by details to specify details shown on the incident’s History tab. Details are automatically added when a workflow action is taken, such as “incident assigned to jdoe.” If administrators add comments to the incident (Workflow > Add Comments), those are appended to the workflow details.

Enter the text for which to search. It is possible to search for all or part of the detail text. For example, enter “closed” to search for incidents that were closed during a certain period.

As always, this filter depends on the other filters that have been selected, such as Incident Time and Ignored Incident. To filter only by history, define a large range for Incident Time, then define the history filter.

Note that complex filters can affect performance.

• be equal to
• be greater than
• be less than
• not be equal to

Filter incidents by a previously-defined tag. (See Tagging incidents). Select the tags by which to filter the report and click Add. Continue until all required tags have been added.

These can be used to group incidents for external applications. Note that complex filters can affect performance.

Filter incidents by the date and time they were written to the database. An incident is an event that breaches policy. (An event is any transaction being analyzed.)

Select a date range, then select a time of day.

Date Range

• Last n days - Select this option to display incidents from the last n days, then select the number of interest. For example, display incidents from the last 30 days.
• Time period - Select this option to display incidents that transpired in a set period of time, then select the period. Example: last 24 hours, this week, or last month.
• Exact date and time - Select this option to display incidents that transpired during a time period that you define, then select the From and To dates and times from the drop-down lists.

For example, you can show incidents starting from 5:00 a.m. on April 1, 2009 to midnight April 30, 2009. Using the Time of Day options below this, you can specify whether to show all incidents from this period (Entire day) or just those from a time range, for example, 8 a.m. to 5 p.m. If you choose this From/To option, the report would include incidents from 8-5:00 on April 1, 8-5:00 on April 2, and 8-5:00 all other days of April, up to and including April 30.

Time of Day

By default, incidents are displayed no matter what time of day they occurred, as long as the date range matches. To display only those incidents that occurred at certain times of day, select From and choose a time range.

• Entire day - Select Entire day to show all incidents during the date range, no matter what time of day they took place.
• From ... to ... - Select this option to show only incidents from a specific period.

For example, if you select Last 60 days and From 8 a.m. to 5 p.m., the report displays all incidents from the last 60 days that were detected between 8 a.m. and 5 p.m.

If you prefer, you can view incidents that occurred during off-peak hours, such as 5 p.m. to 8 a.m. the next day. That way you know if information is being leaked at night when no one is around.

Use the All policies check box or the individual check boxes for different policies to set the policy’s incidents to be displayed in the incident list.

View only incidents that were initiated by specific sources. Select sources from the resource list or enter them as free text. Choose which method to use from the drop-down list. If a free text entry includes a comma, enclose the value in quotes. For example: “Doe, John”.

If there is a role in which source and destination information is hidden for privacy reasons, optionally enter one or more source IDs.

Note that the filter returns values from all columns describing the source, such as URL category, hostname, IP address, and domain.

Complex filters can affect performance.

See Selecting items to include or exclude in a policy for more details on using this selector.

Select which incident triggers to display in the incident list. In the field, enter a violation trigger of interest and click Add. Continue until all required triggers have been added.

Note that complex filters can affect performance.

Limit which channels’ incidents are displayed in the report.

The list of available channels depends on channels configured in the Security Manager.

Email Direction is available only for those with the Forcepoint Email Security module, endpoint agent, or protector.

To see when data in violation of policy was accessed, use this filter, then select dates and times.

Display incidents for data accessed within the last x days, within a date range, or on exact dates. It is also possible to specify time periods.

To see when a file in violation of policy was created, use this filter, then select dates and times.

Display incidents for data created within the last x days, within a date range, or on exact dates. It is also possible to specify time periods.

To see when a file in violation of policy was modified, use this filter, then select dates and times.

Display incidents for data modified within the last x days, within a date range, or on exact dates. It is also possible to specify time periods.

Select incidents by the date and time the policy engine first saw the transaction.

For filter properties, select one of the following:

• Last nn days - Select the number of days from the spinner.
• Time period - Select the range from the drop-down list. Example: last 24 hours or this week.
• Exact dates - Select the From and To dates from the drop-down lists.

Filter using the name of the detected file.

You can choose to add or remove terms to be used as file names using the Include and Exclude options. You can enter the term (wildcards can be used), and click Add. You can use the Remove option to remove an item from the list. Continue until all required file names have been added.

Filter incidents by file permissions. Type a standard Access Control List (ACL) permission into the field box (such as USER name, password, services, or roles), then click Add. The values apply to all file-system scanning and Windows shares.

Split multiple rows by commas and single rows by colons. For example:

Unix user\ramon:rwx,Unix Group\developers:r- x,\Everyone:r--

Filter incidents by the date, administrator, or details contained on the incident History tab. For example, display all incidents that jdoe closed during March 2017.

• Select Filter by date to specify the date and time of the actions that were taken. Only actions during this period are included in the report. Select a date range and time of day.
• Select Filter by administrator to specify the administrator who performed the listed workflow action. Enter the administrator name or names. Separate multiple names by commas. For example: Type “jdoe, bsmith” to view incidents that jdoe and bsmith acted on.
• Select Filter by details to specify details shown on the incident’s History tab. Details are automatically added when a workflow action is taken, such as “incident assigned to jdoe.” If administrators add comments to the incident (Workflow > Add Comments), those are appended to the workflow details.

Enter the text for which to search. It is possible to search for all or part of the detail text. For example, enter “closed” to search for incidents that were closed during a certain period.

As always, this filter depends on the other filters that have been selected, such as Incident Time and Ignored Incident. To filter only by history, define a large range for Incident Time, then define the history filter.

Note that complex filters can affect performance.

• be equal to
• be greater than
• be less than
• not be equal to

Filter incidents by a previously defined tag (see Tagging incidents). Select the tags by which to filter the report and click Add. Continue until all required tags have been added.

Use these tags to group incidents for external applications. Note that complex filters can affect performance.

Use this filter to show incidents that are locked or unlocked. There are two options:

• Show only locked incidents (and not unlocked incidents)
• Exclude locked incidents (and show only unlocked incidents) Disable the filter to display both locked and unlocked incidents.

Locking an incident prevents it from being overwritten with new data in subsequent scans. (To lock an incident, choose Workflow > Lock in the Discovery incident report.)

This filter applies only to Exchange discovery.

• Select Private mailbox to display incidents from private mailboxes.
• Select Public mailbox to display incidents from public mailboxes. Both can be selected at the same time.

Use the All policies check box or the individual check boxes for different policies to set the policy’s incidents to be displayed in the incident list.

Select which incident triggers to display in the incident list. In the field, enter the list of violation triggers to be displayed, separated by commas.

Note that complex filters can affect performance.