Video Screencast Help

Create a report showing file name contains @GMT

Created: 21 May 2013 • Updated: 21 May 2013 | 2 comments
jjesse's picture

DLP on the Endpoint Reporting Question here:

I'm tracking copy from Network to Local Drive and also Local Drive to network through my Endpoint Agent Configuration

Here's the scenario:

A Helpdesk Ticket is created to restore a file as it was either moved/deleted/copied/etc.and now the user can't find it...  Someone is assigned the job of restoring from backup the incident.  Right click folder, previous versions, restore the file.  

 

As this file passes through EXPLORER.exe it generates an incident if the file violates a policy.

Each incident contains the file name of @GMT and then the time stamp.  I would like to filter on all incidents that have that @GMT in its file name.  I've tried "Contains Ignore Case" and "Contains Any of" but when I apply the filter no results are found.

 

What should my filter bet?

Operating Systems:

Comments 2 CommentsJump to latest comment

yang_zhang's picture

You can use filter to create such report.

From a default report, for example, the 'Incidents - All', clieck 'Advanced Filters & Summarization', then click 'Add filter', on the drop-down list, select 'Attachment File Name', then input @GMT.

Just as the below screenshot:

File_Name_Filter.png

If a forum post solves your problem, please flag it as a solution. If you like an article, blog post or download vote it up.
jjesse's picture

So the file I'm looking for doesn't show up as an "attachement" in the incident it acutally shows up as listed as a file location

Jonathan Jesse Practice Principal ITS Partners