Video Screencast Help

Search for SSN inside of the DLP incidents

Created: 16 Jan 2013 | 3 comments

Hello, I was wondering if there was a way that I can search all incidents for a specific SSN.

So basically, I have an SSN and I want to search all of the incidents to date to see if this particular incident popped up. Is there any way to search within the actual match itself within the incident?

Discussion Filed Under:

Comments 3 CommentsJump to latest comment

stumunro's picture

off the top of my head no idea... i would probally guess may be ITA

John_Gruhn's picture

You could do an XML export with incident violations enabled and then process that resulting file. The resulting file would be huge and depending on how many hits you get it may not be manageable at that size but it would show that prior events occured. if you have someone with decent expereince in putting the XML into a searchable database you could leverage it more.

kishorilal1986's picture

yes, it has search filter in which u enter specific SSN no and search in attachement or in body.