Filtering File Activity Events
In the File Activity view, you can filter the file events that are displayed.
You can filter by the fields in the table.
|
Filter |
Description |
|---|---|
| Period | Time period or date range during which the file events occurred. |
| Show time by |  to switch between the local time where the endpoint is located and the time where the server is located. (See Showing Agent Time.) |
| File name | Name of the file on which you want to track activity. |
| File path | Full directory path of the file on which you want to track activity. |
| File extension | Extension of the file showing its type (for example: pdf, xlsx, txt, ppt, ...). |
| User login or secondary | To display file events according to the login name/secondary identification of the user that ran the session in which the file activities occurred, select a specific login/user name from the list, or select All. |
| File size | Maximum or minimum file size. File size is in KB. (The conversion rate is 1 KB equals 1000 bytes.) |
| File operation |
The action that was performed on the file. Options include:
|
| Application | The application that performed the action on the file. Available options are listed for selection; or you can select All. |
| Website | Website from which the file was downloaded. |
| Entry Point | Entry Point filter, includes Web Download, Cloud Sync Folder or Email. |
| Exit Point | Exit point filter, includes USB, Web Upload, Cloud Sync Folder or Email. |
| File MIP label |
Filters by MIP label of the file. You can select the label from the dropdown list.
|
|
Initial file name |
The name of the tracked file before any action was taken on it. |
|
Initial file path |
The full path of the tracked file before any action was taken on it. |
|
Endpoint |
To display file activities according to the endpoints on which the file activity occurred, select a specific endpoint from the list of available endpoints, or select All. When possible, Endpoints are also listed by IP address. |
|
Endpoint group |
To display file activities according to the endpoint group that includes the endpoints on which the file activities occurred, select a specific endpoint group (Active Endpoints or Windows Servers) from the list of available groups, or select All. |
|
Client |
To display file activities according to the client computer from which the user who ran the session logged in, select a specific client from the list, or select All. |
When you have finished defining your filter criteria, click Show to update the Events list according to the specified details. See File Activity View.
To clear the filter fields, click Reset.
Related Topics:
Monitoring File Activity to Identify and Prevent Data Exfiltration