Viewing the incident list

Administrator Help | Forcepoint DLP | Version 8.8.2

Related topics:

Previewing incidents

Managing incident workflow

Remediating incidents

Escalating incidents

Managing incident reports

Tuning policies

To view a list of data loss prevention incidents from the last 3 or 7 days, and their details:

In the Forcepoint Security Manager, go to the Data > Main > Reporting > Data Loss Prevention page.

From Recent Reports, select Incidents (last 3 days) or Incidents (last 7 days).

To view a list of mobile device incidents from the last 3, 7, or 30 days, and their details:

Select Main > Reporting > Mobile Devices.

From Recent Reports, select Mobile Incidents (last 3 days) or Mobile Incidents (last 7 days) or Mobile Incidents (last 30 days).

To view a list of discovery incidents and their details:

Select Main > Reporting > Discovery.

From Recent Reports, select Incidents.

The top portion of the resulting screens lists incidents, their status, the action taken, and many more details.

The incidents list is a table displaying all data loss prevention, mobile device, or discovery incidents. By default, incidents are sorted by their incident time, but you can sort them (ascending or descending) by any of the columns in the table. For each incident, a quick preview of the data is provided. You can customize the types of details shown. (See Editing table properties.)

Click the down arrow on column header to sort, filter, or group incidents by that column. (See Applying a column filter for more information.) Or click Table Properties

to change the columns that are displayed, their order, and their width. See Table Properties tab for a description of each property.

Use the table controls to jump to the first, last, previous, or next incident in the list.

Select an incident to view details about it in the bottom portion of the screen. (See Previewing incidents for more information about what is displayed.)

Use toolbar buttons to manage incident workflow, remediate incidents, escalate incidents, change incident filters or table properties, and more.

Toolbar buttons

Administrator Help | Forcepoint DLP | Version 8.8.2

There are several buttons on the incident toolbar:

Click this button to manage the workflow of the selected incident, then select one of the following:

Assign - Select this option to assign the incident to someone or mark it as unassigned.

Lock - Select this option to lock the selected incident, preventing any further changes from future scans of the file. This option applies only to discovery incidents.

Unlock - Select this option to unlock a locked incident, allowing information from future scans to overwrite the current data. This option applies only to discovery incidents.

Change Status - Select this option to change the incident status or change the status labels.

Change Severity - Select this option to change the incident severity assignment.

Ignore Incident - Select this option to mark an incident as ignored or unmark an ignored incident. Mark an incident as ignored when you've reviewed it and no action is required.

Tag Incident - Select this option to associate an incident with a custom tag that you can later use in filters.

Add comments - Annotate the incident.

Download Incident - Select this option to download an incident. This option applies only to data loss prevention incidents. You can download just one incident at a time. This option applies only to DLP and mobile incidents.

Delete - Select this option if you want to delete incidents. Depending on the type of incident (network, endpoint, mobile, or discovery), you may be able to delete selected incidents, all incidents that match the filter criteria for the current report, or all incidents.

(See Managing incident workflow for details on all of these options.)

Remediate

Click this button to remediate the selected incident, then select one of the following:

Release - Select this option to release the selected incidents (email messages) from quarantine. This option applies only to data loss prevention incidents on network, endpoint, and mobile email channels. You can add a comment to the confirmation window for future reference if desired. Not supported for messages detected by Forcepoint Email Security Cloud.

Run Remediation Script - Select this option to run a remediation script on the selected incident.

(See Remediating incidents for details on both options.)

Escalate

Click this button to escalate the selected incident to a manager or other person:

Email to Manager - Select this option to email the incident to the manager of the person generated the policy breach.

Email to Other - Select this option to email the incident to another person for action.

(See Escalating incidents for details on both options.)

Manage Report

N/A

Click this button to edit the filter or table properties applied to the current report, then select one of the following:

Edit Filter - Select this option to edit the filters applied to the report—for example, choosing a longer time period or single channel.

Table Properties - Select this option to customize the properties of the incident table.

Save - Select this option to save the changes you made to current report.

Save As - Select this option to save the current report with a new name.

(See Managing incident reports. for details on all of these options.)

Settings

Lets you set preferences for incident lists and reports. For example, for data loss prevention incidents, you can define attachment size and forensics settings. For discovery incidents, you can set database thresholds. You can also define general settings, like filtering and printing, that apply to all types of incidents.

For information on configuring these settings, see Setting reporting preferences.

View

Lets you customize the view in your incident list. You can choose any of the following:

Incident list only - Removes the preview so that many more incidents can appear in the list.

Incident preview only - Removes the list so you can preview more of the incident.

Incident list and preview - Displays the incident list and the preview in the same window. Includes scroll bars on the incident list.

Open preview in a new window - Opens a preview of the incident in a new window, so you can view it in its entirety.

Print Preview

Display a preview of the current, selected, or all filtered incidents.

Export to PDF

Export the current, selected, or all filtered incidents to a PDF file.

Export to CSV

Export all filtered incidents to a CSV file (incidents from the current report).

To preview an incident and learn more about it, click on the table row of the incident in the Incidents List. See Previewing incidents for details on this portion of the window.