The Action filter enables you to filter incidents by the action (including those on endpoints) that was performed on the incident. Select the check box for each action to be displayed.

The Application Name filter enables you to filter incidents by the name of applications found in the incidents. Select the applications to include in the report.

The Assigned to filter enables you to filter incidents by the person to whom they are assigned. Unassigned displays all incidents that have not been assigned to any administrator. Because filters can be available for all administrators, checking the Assigned to current administrator check box displays incidents assigned to the administrator who is currently logged onto the Security Manager. Assigned to selected administrators enables you to select specific administrators whose assigned incidents you want to display.

The Business Unit filter enables you to filter incidents by the business unit to which they're assigned.

The Channel filter enables you to limit which channels' incidents are displayed in the report. The list of available channels depends on channels configured in the Security Manager.

Click Edit to add or remove content classifiers to the filter, then select a threshold for each.

The Content Classifier Type filter enables you to select which content classifier type should be displayed in the incident list (key phrases, dictionaries, etc.)

The Cloud Service channel lets you view incidents from specific cloud services, such as those from Box. Requires the DLP Cloud Applications agent.

The Destination filter sets the incident list to display only incidents that were directed at specific destinations.

Select Enable filter to select destinations from your resource list or enter them as free text. Choose which method you want to use from the drop-down list. If your free text includes a comma, enclose the value in quotes. For example: "Doe, John".

See Selecting items to include or exclude in a policy for more details on using this selector.

The Detected by filter sets the incident list to display only incidents intercepted that were detected by specific Forcepoint DLP modules. Select each module to be displayed. The list of available modules depends on which modules were configured on the Security Manager System Modules page.

The Endpoint Type filter enables you to filter incidents according to the type of endpoint client, e.g. laptop or static device (such as workstations). In the Filter Properties pane, select the endpoint type.

The Event Time filter lets you filter incidents by the date and time the policy engine first saw a transaction. An event is any transaction being analyzed. (An incident is an event that breaches policy.)

By default, incidents are displayed no matter what time of day they occurred, as long as the date range matches. To display only those incidents that occurred at certain times of day, select From and choose a time range.

This filter enables you to filter in or out incidents involving certain files. Enter the file name (wildcards can be used), and click Add. Continue until you've added all you need.

The Ignored Incident filter lets you filter in or out ignored incidents. By default, ignored incidents are filtered out of all reports.

Incident Tags let you filter incidents by a tag you earlier defined. (See Tagging incidents). Select the tags by which to filter the report and click Add. Continue until you've added all you need.

By default, incidents are displayed no matter what time of day they occurred, as long as the date range matches. To display only those incidents that occurred at certain times of day, select From and choose a time range.

Use this filter to select the severity of incidents to display. Select High if you want to display incidents of high severity, and so on. Select as many severity levels as desired.

The Source filter lets you view only incidents that were initiated by specific sources. You can select sources from your resource list or enter them as free text. Choose which method you want to use from the drop-down list. If your free text includes a comma, enclose the value in quotes. For example: "Doe, John".

See Selecting items to include or exclude in a policy for more details on using this selector.

The Status filter enables you to select which incidents to show by their status—for example, New, Closed, In Process, False Positive, or Escalated. You cannot filter by statuses that have been deleted from the system.

The Top Matches filter allows you to filter according to the rule that triggers the most matches. For example, if rules A, B, and C trigger incidents in MyPolicy; the one that has the most matches would be included.

The Violation Triggers filter lets you select which incident triggers to display in the incident list. In the field, enter a violation trigger of interest and click Add. Continue until you've added all you need.

The Action filter enables you to filter incidents by the action that was performed on the incident. Select the check box for each action to be displayed.

The Assigned to filter enables you to filter incidents by the person to whom they are assigned. Unassigned displays all incidents that have not been assigned to any administrator. Because filters can be available for all administrators, checking the Assigned to current administrator check box displays incidents assigned to the administrator who is currently logged onto the Forcepoint Security Manager. Assigned to selected administrators enables you to select specific administrators whose assigned incidents you want to display.

The Business Unit filter enables you to filter incidents by the business unit to which they're assigned.

Click Edit to add or remove content classifiers to the filter, then select a threshold for each.

The Classifier Type filter enables you to select which content classifier type should be displayed in the incident list (key phrases, dictionaries, etc.)

The Destination filter sets the incident list to display only incidents intercepted that were directed at specific destinations. You can select destinations from your resource list or enter them as free text. Choose which method you want to use from the drop-down list. If your free text includes a comma, enclose the value in quotes. For example: "Doe, John".

See Selecting items to include or exclude in a policy for more details on using this selector.

The Detected by filter sets the incident list to display only incidents intercepted that were detected by specific Forcepoint DLP modules. Select each module to be displayed. The list of available modules depends on which modules were configured on the Security Manager System Modules page.

The Event Time filter lets you filter incidents by the date and time the policy engine first saw a transaction. An event is any transaction being analyzed. (An incident is an event that breaches policy.)

By default, incidents are displayed no matter what time of day they occurred, as long as the date range matches. To display only those incidents that occurred at certain times of day, select From and choose a time range.

This filter enables you to filter in or out incidents involving certain files. Enter the file name (wildcards can be used), and click Add. Continue until you've added all you need.

The Ignored Incident filter lets you filter in or out ignored incidents. By default, ignored incidents are filtered out of all reports.

Incident Tags let you filter incidents by a tag you earlier defined. (See Tagging incidents). Select the tags by which to filter the report and click Add. Continue until you've added all you need.

By default, incidents are displayed no matter what time of day they occurred, as long as the date range matches. To display only those incidents that occurred at certain times of day, select From and choose a time range.

Rule Name lets you filter incidents by the rules they triggered.

Use this filter to select the severity of incidents to display. Select High if you want to display incidents of high severity, and so on. Select as many severity levels as desired.

The Source filter lets you view only incidents intercepted that were directed at specific sources. You can select sources from your resource list or enter them as free text. Choose which method you want to use from the drop-down list. If your free text includes a comma, enclose the value in quotes. For example: "Doe, John".

See Selecting items to include or exclude in a policy for more details on using this selector.

The Status filter enables you to select which incidents to show by their status—for example, New, Closed, In Process, False Positive, or Escalated. You cannot filter by statuses that have been deleted from the system.

The Top Matches filter allows you to filter according to the rule that triggers the most matches. For example, if rules A, B, and C trigger incidents in MyPolicy; the one that has the most matches would be included.

The Violation Triggers filter enables you to select which incident triggers to display in the incident list. In the field, enter a violation trigger of interest and click Add. Continue until you've added all you need.

The Assigned to filter enables you to filter incidents by the person to whom they are assigned. Unassigned displays all incidents that have not been assigned to any administrator. Because filters can be available for all administrators, checking the Assigned to current administrator check box displays incidents assigned to the administrator who is currently logged onto the Forcepoint Security Manager. Assigned to selected administrators enables you to select specific administrators whose assigned incidents you want to display.

The Channel filter enables you to limit which channels' incidents are displayed in the report.

The Content Classifier Name filter enables you to select which specific content classifiers should be displayed in the incident list.

The Content Classifier Type filter enables you to select which content classifier type should be displayed in the incident list (key phrases, dictionaries, etc.)

The Detected by filter sets the incident list to display only incidents that were detected by specific Forcepoint DLP modules. Select each module of interest. The list of available modules depends on which modules configured on the Security Manager System Modules page.

The Endpoint Type filter enables you to filter incidents according to the type of endpoint client, e.g. laptop or static device.

This filter allows you to view incidents from a certain folder or folders. Type a valid folder name into the field box, then click Add.

This filter enables you to filter in or out incidents involving certain files. Enter the file name (wildcards can be used), and click Add. Continue until you've added all you need.

Use this filter to filter incidents by file owner. Type a valid owner name into the field box, then click Add.

Use this filter to filter incidents by file permissions. Type a standard Access Control List (ACL) permission into the field box (such as USER name, password, services, or roles), then click Add. The values apply to all file-system scanning and Windows shares.

Use this filter to filter incidents by folder owner. Type a valid owner name into the field box, then click Add.

Use Host Name to filter incidents by the host on which they were detected. Type a valid hostname into the field box, then click Add.

The Ignored Incident filter lets you filter in or out ignored incidents. By default, ignored incidents are filtered out of all reports.

Incident Tags let you filter incidents by a tag you earlier defined. (See Tagging incidents). Select the tags by which to filter the report and click Add. Continue until you've added all you need.

Use IP Address to filter incidents by the host on which they were detected. Type a valid IP address into the field box, then click Add.

Locking an incident prevents it from being overwritten with new data in subsequent scans. (To lock an incident, choose Workflow > Lock in the Discovery incident report.)

This filter applies only to Exchange discovery. Select Private mailbox if you want to display incidents from private mailboxes. Select Public mailbox if you want to display incidents from public mailboxes. You can select both if desired.

Use this filter to select the severity of incidents to display. Select High if you want to display incidents of high severity, and so on. Select as many severity levels as desired.

The Status filter enables you to select which incidents to show by their status—for example, New, Closed, In Process, False Positive, or Escalated. You cannot filter by statuses that have been deleted from the system.

The Top Matches filter allows you to filter according to the rule that triggers the most matches. For example, if rules A, B, and C trigger incidents in MyPolicy; the one that has the most matches would be included.

The Violation Triggers filter enables you to select which incident triggers to display in the incident list. In the field, enter the list of violation triggers to be displayed, separated by commas.