Data Loss Prevention

Hi All,

How to find Incident and events in symantec DLP

Hi Mohan, 

Your query is not enogh to understand, I mean If u have accessed to DLP you can see DLP incidents but still I am providing the what i understand ur requirements.

Please refer below for detailed incidents and also find the attched image

https://www-secure.symantec.com/connect/articles/create-dlp-incidents-reviewer-each-independent-departments-business-units

To see events you can go to System Tab>events

In this you will see all the events that currently occured

hello

to view incidents, it will depend which type you wanna see (network, discover, or ednpoint) but you can go to "Incident/All reports" and then select "Network/Incidents - All" report to have access to list of all incidents available in the tool. Of course it also depend of profile you use to connect to DLP, as there can be some restriction defined on your profile but if you use Administrator account, you wont have any issue to view incidents.

 regards

Hi Mohan,

As DLP having Role Based Access, you can see the details which are assigned to you.In DLP for different role like reviewer, Administrator, Investigator etc. having access to detailes as per there role.

When you login,In Incident tab you will find network and enpoints , after clicking on each button u will see nw/end incidents. you can filterout these incidents as policywise, department wise etc.

For events you can see in system tab, you can configure automated mail genearte for specific event by adding its event code parameter.

Hi,

Can u provide me the steps in DLP Server to view both the incidents (Endpoint and Network).

check this screen capture to know the incidents.

Hi Mohan,

As currently I am assigned to work on Symantec Endpoint so that I have not access to DLP. I regret that I am unable to provide u the steps but I can say, If u have acces and enough previlages to DLP, u can easily see both incident which is also can be seen on above attch snapshot.