10.6 Sensitive Information Logs
Sensitive information logs record files that match sensitive content in full-disk scan tasks, external transmission control policies, and local storage control policies. By reviewing these logs, administrators can track where these files are stored on users' drives and how users interact with them, providing audit trails for investigating potential data leaks.
Select Sensitive Information → Sensitive Information Logs to view all file operation logs matching sensitive content, including Type, Encryption, Restriction, Warning, Time, Computer, Computer Group, User, User Group, Information Classification, File Name, Path, File Size, and Description.
| Attribute Name |
Description |
| Type |
The operation that triggered the scan, including copying to a removable drive, copying to a network drive, IM file transfer, sending emails, creating, modifying, scanning, or uploading documents. |
| Information Classification |
All selected information classifications in the policy matched by the file. |
| Document Tag |
The document's tag information. |
| Document Classification |
The document's classification level. |
| File Name |
The name of the file. |
| File Path |
The file's location. For browser uploads, the format is: Source Path → Destination Path; for non-browser uploads, only the file's path is shown. |
| File Size |
The size of the file. |
| File Access Time |
The last time the file was accessed. |
| File Modification Time |
The last time the file was modified. |
| Watermark Added |
Indicates whether a watermark was applied to the file by the policy or task. |
| Encrypted |
Indicates whether the file was encrypted by the policy or task. |
| Restricted |
Indicates that the policy blocked the file from being transmitted externally. |
| Warning |
Console displays a warning after the policy is triggered. |
| Description |
Records additional details about the operation, such as the tool used for IM transfer or the email details when transmitted via email. |
In addition to common filters such as Time, Time Type, and Range, sensitive information logs can also be queried using the following criteria:
| Query Criteria |
Description |
| Operation Type |
By default, all operation types are included. You can select one or more types from the dropdown, e.g., newly created or modified documents. |
| Information Classification |
By default, all classifications are included. You can select one or more classifications from the dropdown; logs matching any selected classification will appear in the results. |
| Document Tag |
The document's tag content. |
| Document Classification |
The classification range of the file. |
| Path |
The file's location. |
| Size |
The file size range. |
| Document Name |
The name of the file. You can choose from default types or manually add type names when searching by type. |
| Has Backup |
Check to query only logs of files with backups. |
| Watermark Added |
Check to query only logs of files with watermarks applied. |
| Encrypted |
Check to query only logs of encrypted files. |
| Restricted |
Check to query only logs of files blocked from transmission. |
| Warning |
Check to query only logs that triggered warnings. |
Note:
- When a file containing sensitive content or triggering a policy is inside a compressed archive, a separate log entry is created for each file that matches the sensitive content.
Right-clicking a log entry allows you to Print, Print Preview, Export Log, Export Backup Document, Delete Log, or View Screen History.
In the Sensitive Information External Transmission Control Policy, you can configure a backup copy policy. When a client triggers this policy, a backup document log is recorded. Logs with backup documents are marked with a pin icon " 
".
Supported backup types include: copying to a removable drive, copying to a network drive, IM file transfer, sending emails, and uploading files.
Double-clicking a backup document log opens its detailed properties. Next to the document name is a "Copy" button, which allows you to view or save the backup document. Backup documents can also be exported in bulk via the "Export Backup Document" option in the right-click menu, either for selected logs or all records.
Note:
- Since backup copies in sensitive information logs actually exist in document operation or email logs, deleting the corresponding backup files from those logs during data cleanup will also remove the copies from the sensitive information logs, making them unavailable for review.
Don't see what you're looking for?
