Data Loss Prevention

So it appears I have a user that has not had their laptop on the network for awhile to connect to the Endpoint server and all of the sudden it is flooding DLP with incidents. I have checked over all of my incidents and I cannot locate who or what system is generating the incidents.

So, I see incidents coming in right now that occured at a different date. Is there anyway I can see what incidents are coming in now even if it occured on a different date without knowing the exact date?

Hi,

You can set a report based on:

• Satus -> Equals -> New
• Date: All Dates
• Advanced Filters & Summarization
  • Summarize By: Week, month, etc (whatever suits your needs) + User Name / Machine ID / IP (...)

This is just a possibility to "isolate" incidents and you can "play" with variables you want.

Regards.

If you can find one of the new incidents, you can click on the endpoint name and get a report of all of the incident sassociated to that Endpoint.

You can also do the same thing with a custom report of the 'machine name'

Good Luck, 

Ronak

Hello Mike,

Do you try to use this filter : Incident Reported on

Regards.

Thomas