Platform Deployment Guide › iConsole Standard Searches, Reports and Policies › Standard Searches, Reports and Dashboard › Available Reports › Incident Reports

Incident Reports

These include:

Incident Rate By Policy Report

Shows a breakdown of all the policies that have been triggered over a specified period, showing their counts as a percentage of all events processed. By default, it includes all policies, but it can be refined to focus on just a subset. It calculates percentages based on all events in the database captured over the specified period.

Incident Summary Report

Shows how many times a user (employee) has caused a trigger to fire during a specified period. You can use this report to search for details of captured events associated with a specific user, group or trigger, incoming or outgoing events, or events captured over a specific period.

Incidents By Location Report

Provides a summary of 'Data At Rest' trigger violations by file location (that is, the host machine and folder containing the file). It shows the number of incidents for each file location.

Incidents By Policy and Action Report

Shows how many file policies were triggered and the subsequent actions (for example, capture, delete, move, or copy a file).

Incidents By Policy and Channel Report

Shows the number of violations by policy or class for specific users or groups, broken down by channel. For example, it shows how many violations were caused by emails, FTP transfers or instant messages. Reviewers can analyze the results to see which policies trigger most often and on which communication channels.

Incidents By Policy and Time Period Report

Shows the number of violations over time broken down by policy or class, for specific users or groups. For example, it can show changing violation counts on a weekly or monthly basis. Reviewers can analyze the results at a policy or class level to understand the overall trend over time.

Incident Cause Frequency Report

Shows incident counts for specific policy conditions: Parameter 7 words detected by a Document Classifier trigger; e-mail senders; and e-mail subject lines. This diagnostic report is designed for policy administrators. It allows them to understand how policy is being applied to real data and, if necessary, to fine tune those policies to reduce false positive results. Note that you can also drill down into the results to see the individual events.