Filter incidents by the person to whom they are assigned. Unassigned displays all incidents that have not been assigned to any administrator. Because filters can be available for all administrators, checking the Assigned to current administrator check box displays incidents assigned to the administrator who is currently logged onto the Security Manager. Assigned to selected administrators enables you to select specific administrators whose assigned incidents you want to display.

Select CASB Service to view incidents detected when users synced or shared files with cloud applications such as Microsoft OneDrive for Business or Box. (Enable the CASB Service on the Settings > General > Service page.)

Click Edit to add or remove content classifiers to the filter, then select a threshold for each.

Select Enable filter to select destinations from your resource list or enter them as free text. Choose which method you want to use from the drop-down list. If your free text includes a comma, enclose the value in quotes. For example: "Doe, John".

See Selecting items to include or exclude in a policy for more details on using this selector.

Filter incidents according to the type of endpoint client, e.g., laptop or static device (such as workstations). In the Filter Properties pane, select the endpoint type.

By default, incidents are displayed no matter what time of day they occurred, as long as the date range matches. To display only those incidents that occurred at certain times of day, select From and choose a time range.

Filter in or out incidents involving certain files. Enter the file name (wildcards can be used), and click Add. Continue until all required file names have been added.

Filter incidents by a previously-defined tag. (See Tagging incidents). Select the tags by which to filter the report and click Add. Continue until all required tags have been added.

By default, incidents are displayed no matter what time of day they occurred, as long as the date range matches. To display only those incidents that occurred at certain times of day, select From and choose a time range.

Select the severity of incidents to display. Select High if you want to display incidents of high severity, and so on. Select as many severity levels as desired.

See Selecting items to include or exclude in a policy for more details on using this selector.

Select which incident triggers to display in the incident list. In the field, enter a violation trigger of interest and click Add. Continue until all required triggers have been added.

Filter incidents by the person to whom they are assigned. Unassigned displays all incidents that have not been assigned to any administrator. Because filters can be available for all administrators, checking the Assigned to current administrator check box displays incidents assigned to the administrator who is currently logged onto the Forcepoint Security Manager. Assigned to selected administrators enables you to select specific administrators whose assigned incidents you want to display.

Click Edit to add or remove content classifiers to the filter, then select a threshold for each.

See Selecting items to include or exclude in a policy for more details on using this selector.

By default, incidents are displayed no matter what time of day they occurred, as long as the date range matches. To display only those incidents that occurred at certain times of day, select From and choose a time range.

Filter in or out incidents involving certain files. Enter the file name (wildcards can be used), and click Add. Continue until you've added all you need.

Filter incidents by a previously-defined tag (see Tagging incidents). Select the tags by which to filter the report and click Add. Continue until all required tags have been added.

By default, incidents are displayed no matter what time of day they occurred, as long as the date range matches. To display only those incidents that occurred at certain times of day, select From and choose a time range.

Select the severity of incidents to display. Select High to display incidents of high severity, and so on. Select as many severity levels as desired.

See Selecting items to include or exclude in a policy.

Select which incident triggers to display in the incident list. In the field, enter a violation trigger of interest and click Add. Continue until you've added all you need.

Filter incidents by the person to whom they are assigned. Unassigned displays all incidents that have not been assigned to any administrator. Because filters can be available for all administrators, checking the Assigned to current administrator check box displays incidents assigned to the administrator who is currently logged onto the Forcepoint Security Manager. Assigned to selected administrators enables you to select specific administrators whose assigned incidents you want to display.

View incidents from a certain folder or folders. Type a valid folder name into the field box, then click Add.

Filter in or out incidents involving certain files. Enter the file name (wildcards can be used), and click Add. Continue until all required files have been added.

Filter incidents by file owner. Type a valid owner name into the field box, then click Add.

Filter incidents by file permissions. Type a standard Access Control List (ACL) permission into the field box (such as USER name, password, services, or roles), then click Add. The values apply to all file-system scanning and Windows shares.

Filter incidents by folder owner. Type a valid owner name into the field box, then click Add.

Filter incidents by the host on which they were detected. Type a valid hostname into the field box, then click Add.

Filter incidents by a previously-defined tag (see Tagging incidents). Select the tags by which to filter the report and click Add. Continue until all required tags have been added.

Filter incidents by the host on which they were detected. Type a valid IP address into the field box, then click Add.

Locking an incident prevents it from being overwritten with new data in subsequent scans. (To lock an incident, choose Workflow > Lock in the Discovery incident report.)

Select the severity of incidents to display. Select High to display incidents of high severity, and so on. Select as many severity levels as desired.