File Activity Report Configuration

This topic describes the metadata that you can select to be included in an File Activity type report (see Report Types).

For detailed instructions on the steps required to create a report, see Creating a Custom Report.

When creating a File Activity type report, you can specify types of columns for:

File Activity fields: as described in the table
Email Activity fields: see Email Activity Report Configuration
Endpoint fields: see Endpoint Report Configuration
User fields: see User Report Configuration

Type	Column	Description
File Activity	Activity date (UTC)	Date the file activity occurred.
	Activity time (UTC)	Time (from server) the file activity occurred.
	Activity time (local endpoint time)	Time (from local endpoint) the file activity occurred.
	File operation	Operation on the tracked file such as downloaded, exported, uploaded.
	File name	Name of the tracked file.
	File Path	Full directory path of the tracked file.
	Cloud storage sync folder	Name of local cloud sync folder to which the tracked file was moved or copied, such as Dropbox and Box.
	Destination website URL	URL of the website to which the tracked file was uploaded.
	Originating website (URL)	URL of the website from which the tracked file originated.
	Original file name	Name of the tracked file before any action was taken on it.
	Original File Path	Full path of the tracked file before any action was taken on it.
	Source file name	The name of the original file before any changes were made such as a file name change.
	Source File Path	The path where the source file resides.
	Source File extension	The file extension of the source file.
	Destination file extension	File extension of the tracked file after action was taken on it.
	File size	Size of the tracked file.
	Device Serial Number	Serial number of the device, for example, 4C5300001030211117051.
	Device ID	USB Device ID. (In previous versions, USB Device ID is included at the end of the Device Label field.)
	Device Model	Model of the device, for example, SanDisk Cruzer Glide 3.0 USB Device.
	Device currently white listed	Indication (Y/N) whether the device is whitelisted.
	Device Vendor	Vendor of the device, for example, SanDisk.
	Device Label	Label of the device, for example, SanDisk Cruzer Glide 3.0 USB Device.
	Destination is USB	Indication (Y/N) whether the file destination is a USB device.
	Destination device was whitelisted	Indication (Y/N) device was previously whitelisted. It is not currently whitelisted.
	MIP Label (Primary Tenant)	MIP label assigned to the file of the primary tenant.
	MIP Labels (Other Tenant)	MIP label assigned to the file a tenant defined as other (not the primary tenant).
Additional metadata	Application Name	Name of the application with which the user interacted (as shown in the Windows Task Manager).
	Window Title	Title of the window that was opened by the user. Note: As described above, in "Advanced Filters" (Step 3 of the Report Configuration wizard), you can add prefixes to the Window Title to report on USB file insertion, file/folder copying or printing, or large file/folder copying or printing.
	Website Name	Name of the website with which the user interacted (extracted from the URL). Examples: URL: https://www.facebook.com/ => Website name: facebook.com URL: https://www.mail.google.com/mail/ca/u/O/#inbox/ => Website name: mail.google.com
	Process Name	Name of the process that the user was running while interacting with the application (the main executable of the application without the .exe extension). For example: iexplore
	URL	URL from which the website name is extracted.
	Play Video (Button)	Select to display the Video replay icon for playing back the session with the application.