Video Screencast Help
Give us your opinion and win with Symantec! Please help us by taking this survey to tell us about your experience with Symantec Connect, so that we can continue to grow and improve.  Take the survey.

Search for SSN inside of the DLP incidents

Created: 16 Jan 2013 | 3 comments

Hello, I was wondering if there was a way that I can search all incidents for a specific SSN.

So basically, I have an SSN and I want to search all of the incidents to date to see if this particular incident popped up. Is there any way to search within the actual match itself within the incident?

Discussion Filed Under:

Comments 3 CommentsJump to latest comment

stumunro's picture

off the top of my head no idea... i would probally guess may be ITA

John_Gruhn's picture

You could do an XML export with incident violations enabled and then process that resulting file. The resulting file would be huge and depending on how many hits you get it may not be manageable at that size but it would show that prior events occured. if you have someone with decent expereince in putting the XML into a searchable database you could leverage it more.

kishorilal1986's picture

yes, it has search filter in which u enter specific SSN no and search in attachement or in body.