DLP Logs (Logs)
View Logs in the system allows viewing events related to automation and data protection (DLP). This central location enables administrators to monitor operations, analyze activity, and retrieve detailed information about logs related to policies, rules, and events in the IT infrastructure.
Logs
Widgets at the top of the screen
Users by risk:
Displays a list of users with the highest risk scores in the selected period (default: 7 days). Each risk bar shows which rules contribute to the risk score.
Recent Media:
Overview of recently recorded media, such as screen recordings or screenshots. Clicking the preview enlarges the view.
Log table
The table contains detailed information about events. Clicking a row expands the details of the selected log.
Columns in the table
Each column contains information configured during rule creation within the automation or data protection policy:
Policy – The name of the policy from which the log originates.
Rule – The name of the rule that generated the event.
Risk – The risk value for the given log (e.g., 92/100).
Log date – The date and time the log was generated.
Logged in – The username to which the log applies.
Computer – The name of the device from which the log originates.
Operation – The action triggered by the rule, e.g., “Copy” (copying a file).
Process – The name of the process associated with the event, e.g., “chrome.exe”.
File – The name of the file that was part of the event.
Source – The source location of the file.
Target – The location to which the file was moved or copied.
Source device - The device from which the file originated, e.g., local disk, USB.
Target device - The device to which the file was copied or moved.
Source type - The type of source medium, e.g., local disk, network share, USB.
Target type - The type of target medium, e.g., USB, network share.
Process path - The full path to the process executable file.
Target file - The file name after the operation, if different from the source file.
Online - Information on whether the device is online.
LogID - the unique log identifier in the system.
Screenshot available - Information on whether a graphical recording is available for the given event.
Recording available - Information on whether a video recording documenting activity during the incident is available.
Host ID - The unique identifier of the source computer in the system.
Target device ID - The identifier of the target device.
Device ID - The identifier of the source device.
Expandable row details
Clicking a log row opens a detailed view that contains the elements described below.
Media:
Screen recording: Preview of the recording captured at the moment of the event. Clicking opens the recording in full screen.
Screenshot: Screenshot captured at the moment of the event. Clicking enlarges the image.
Notifications:
Information about sent notifications, e.g., email or an alert for the end user.
Action:
List of actions performed as part of the rule, e.g., “Screen recording, Screenshot, Task, Turn off PC”.
Description:
Information about which rule was violated or executed.
Task result:
Link Read the full Log that provides access to the full log with additional operation details.
Additional features
Downloading logs:
Selecting rows in the table and clicking the “Download” icon (down arrow above the table) allows media from the selected logs to be downloaded as a file.
Filtering and searching:
The user can filter logs by any column or use the search field to find a specific event.
The log view is an important analytical tool that enables administrators to track user activity, monitor violations, and analyze the effectiveness of policies in the organization.
Relationships
The tab Relationships shows which security policies and rules are enabled and to which users and computers they are assigned.
To open this view, go to: Data Protection -> Logs -> Relationships.
The tab provides two views:
Computers
Users
In the Computers view, a list of all computers to which at least one security policy has been assigned is displayed. Next to the computer name, a red exclamation mark in a circle - it means that the policies on this device have not yet been updated and are running an older version.
On the right side of each computer, all security rules active on the given device are visible. If the list of rules does not fit in the window, information is displayed at the end in the format + [number] others, for example +1 others.
View Users works similarly to the computer view, but it refers to users. For each user, the assigned security rules are displayed.
The system allows data to be filtered:
by user,
by policy.
The relationships view can be displayed as tiles or a dropdown list. Switching between these modes is located in the upper-right corner of the table.
Last updated
Was this helpful?