Create a New Sensitive Data Scan

From the Dashboard, navigate to Scans > All Scans. To create a new Sensitive Data Scan:

1. In the top-right corner of the All Scans screen, click the Add Scan button.

2. On the next screen, fill in the Name and Description. The Description is optional.

3. Click Next to proceed, Previous to return to the previous screen, or Exit Without Saving
to discard.

4. On the Select what type of scan to create screen, click Sensitive Data Scan. Select Next.

5. On the Select a Playbook to apply to the scan screen, choose a Playbook from the list.

a. If the playbook you want is not listed, you can use the Search field to search for it.

b. To search for a specific Playbook, type the name of the Playbook in the search box and then select the search icon or click Enter.

6. Click Next to proceed, Previous to return to the previous screen, or Exit Without Saving
to discard.

7. On the Select the target type to scan, choose a Target type.

Target Type Options

The Target type scans provide Basic Options and Advanced Options. These options apply to the Cloud, Files & Folders (Local & Remote Scans), Email, Collaboration Tools, and Website target types. They are not available for the Database Target type.

To create your target search, you can select from many options to configure your particular scan and the expanded descriptions for shared options are available by clicking, Shared Options.

Options that are specific to a particular Target type that not shared, are detailed within the Target type section itself.

Expand each of these sections for more information on Target types and creating specific scans.

Create a Cloud Scan

1. Click the Cloud tile.

2. On the Select which cloud service to scan screen, select and click a cloud service tile:

Dropbox

Google Drive

Box

OneDrive for Business

Amazon S3

3. Select the service and the Select the agent(s) to perform the scan screen opens.

4. From the All On-Prem Agents list, choose the agent(s) you want to use.

a. To expand a section, click the chevron (>) icon.

b. To select an agent, click the arrow next to the agent name. This moves the agent over to the Selected On-Prem Agents list.

c. To check the version of an agent, hover your mouse over the information icon to determine the version of the Agent.

Note:Agent 13, Agent 13.1, Agent 13.2, and Legacy Agents cannot be combined. If you select more than one version of the agents, you get an error message and are prompted to reselect your agents.

d. To remove an agent from the Selected On-Prem Agents list, click the arrow next to an agent name in that list.

5. On the Select Targets(s) to Scan screen, select one or more targets to scan.

1) Expand the section and add a target. To add a target, click the arrow next to its name and move it to the Selected Targets list.

2) To remove a target from the Selected Targets list, click the arrow next to the target name and move it back to the All Targets list.

Note: To create a new Target, see Working with Assets and Targets.

6. Click Next to proceed, Previous to return to the previous screen, or Exit Without Saving
to discard.

7. On the Select Which User Accounts Would You Like to Scan screen:

Note: Your cloud source brand is reflected on this screen. However, the screen does not display for Amazon S3 cloud services.

Search: To search for a User Account, type the name in the box and click the Search icon or click Enter.

Input the User Account to add and press Enter: Type the user account name and click Enter.

Upload Account List: To upload a list of accounts from your local computer, click the upload icon and locate the file on your local computer.

8. Click Next to proceed, Previous to return to the previous screen, or Exit Without Saving
to discard.

9. On the Select File Type Scan Options screen, select from the displayed options.

These are the Basic Options for scans. They are shared and available for Cloud, Files & Folders (Local & Remote), Email, Collaboration Tools and Website Target types. They are not available for the Database Target type.

Since the Basic Options are shared, they are detailed and described in the link Shared Options. Click the link ffor details on these options.

Advanced Options are also available for Cloud, Files & Folders (Local & Remote), Email, Collaboration Tools and Website Target types and are not available for the Database Target type. The shared Advanced Options are also detailed and described in the link Shared Options. Click the link for details on these options.

10. Click Next to proceed, Previous to return to the previous screen, or Exit Without Saving
to discard.

11. On the Select file type scan options - Advanced Options screen, select options.

Since they are shared, you can find expanded details and descriptions of these options by clicking, Shared Options.

Click Next to proceed, Previous to return to the previous screen, or Exit Without Saving
to discard.

12. On the Select advanced options screen, select from the Advanced Options.

Since they are shared, you can find expanded details and descriptions of these options by clicking, Shared Options.

13. Click Next to proceed, Previous to return to the previous screen, or Exit Without Saving
to discard.

14. On the Discovery Team Settings screen, select the desired options.

Note: This screen only displays when multiple On-Prem agents are selected.

e. Since the Discovery Team Settings options can be used with any Target type, you can find expanded details and descriptions of these options by clicking, Shared Options.

f. Agent 13.0+: Ensure these ports are open.

Port 5672: Use these settings:
- Open for Inbound TCP communication on the Discovery Agent.
- Open for Outbound TCP communication on ALL. other agents involved in the same scan to the Discovery Agent.

NOTE: This communication is for reading and writing information to the message queue.

Port 15672: Use these settings:
- Open for Inbound TCP communication on the Discovery Agent.
- Open for Outbound TCP communication on ALL other agents involved in the same scan to the Discovery Agent.

NOTE: This is for the Message Queue Management Interface and API.

g. Agent 13.2+: Ensure these ports are open.

Ports 5671 & 5672: Use these settings:

Open for Inbound TCP communication on the Discovery Agent.

Open for Outbound TCP communication on ALL other agents involved in the same scan to the Discovery Agent.

NOTE: This communication is for reading and writing information to the message queue.

Ports 15671 & 15672: Use these settings:

Open for Inbound TCP communication on the Discovery Agent.

Open for Outbound TCP communication on ALL other agents involved in the same scan to the Discovery Agent.

NOTE: This is for the Message Queue Management Interface and API.

h. Discovery Agent: Select an agent from the drop-down list.

Note: Distributed scans use the assigned discovery agent to conduct location discovery and provide a queue for all other agents to be assigned locations for scanning. While the Discovery Agent can be manually chosen, it is recommended that you use the preferred Discovery Agent.

i. Configure Agent IPs: If your organization requires it, you can set a specific IP address.

1) Click Configure Agent IP's.

2) In the Add New IP Address field, enter the new IP address and click the plus (+) icon.

3) Hover over the new IP address options menu and click Make Default.

4) Click Save to apply or Cancel to discard.

j. For Agent 13.0 and legacy Agents, use these options.

Since these Advanced Options are shared across Target types, you can find expanded details and descriptions by clicking, Shared Options.

15. Click Next to proceed, Previous to return to the previous screen, or Exit Without Saving
to discard.

16. The next screen is Select the scan schedule. Click on Select Date and Time to see how to set the date, time, and / or recurrence for a scan.

17. Click Next to proceed, Previous to return to the previous screen, or Exit Without Saving
to discard.

18. On the Who should receive notification of scan completion screen, select how to send email notifications.

I'll Manually Check My Scans Results
Send An Email Notification

k. To send a notification, select a user from the drop-down list or type the email address in the entry field and click Enter.

l. To add additional email addresses, click the plus (+) icon and select or type the email addresses in the entry field. Click Enter.

19. Click Next to proceed, Previous to return to the previous screen, or Exit Without Saving
to discard.

20. On the Summary screen, select the ˅ icon to open and review your scan settings.

21. Use a edit icon link to jump to a specific screen to edit a setting.

22. Click Finish & Save to add the new Scan, Previous to return to the previous screen, or Exit Without Saving to discard.

Create an Email Scan

1. Click the Email tile.

2. When you select Email, the Select an email service provider to search screen opens.

Select either Exchange, Exchange Online, or Gmail.

Expand a section for more information about creating these scans.

Exchange

1. When you select Exchange, the Select the agent(s) to perform the scan screen opens.

Select an agent from the All On-Prem Agents list. To expand the an Agent in the list, select the chevron (>) next to the entry name.

a. To move an agent from the All On-Prem Agents list to the Selected On-Prem Agents list, use the arrow next to the agent name.

b. To move an agent from the Selected On-Prem Agents list to the All On-Prem Agents list, select the agent you want to return. Click the arrow next to the agent name.

2. Click Next to proceed, Previous to return to the previous screen, or Exit Without Saving
to discard.

3. On the Select the target(s) to scan screen, select a target from the All Targets list. To expand a target, click on the chevron (>).

a. To move a target to the Selected Targets list, click the arrow next to the target name.

b. To move a target from Selected Targets to All Targets, click the arrow next to the target name.

5. Click Next to proceed, Previous to return to the previous screen, or Exit Without Saving
to discard.

6. On the Scan servers by account list? screen, upload or enter the accounts you want to include in your scan.

8. You can select actions for the Mailbox Accounts:

Scan Attachments

Scan All Mailboxes

Include Dumpster

Include Online Archive

If you select no Mailbox Accounts for a target then all Mailbox Accounts are scanned.

For Scan All Mailboxes to be checked, it is required that no targets have mailboxes assigned. For Scan All Mailboxes to be unchecked, it is required that all targets have mailboxes assigned.

Click Next to proceed, Previous to return to the previous screen, or Exit Without Saving
to discard.

9. The next screen is Select file type scan options.

10.

These options are shared by several Target types and their details can be viewed by clicking Shared Options.

To select Advanced Options, click the button upper, right of the screen. The button label changed to Basic Options. You can select the Basic Options button again to return to the previous screen.

Click Next to proceed, Previous to return to the previous screen, or Exit Without Saving
to discard.

11. If you click the Advanced Options button, the Select file type scan options - Advanced Options screen opens.

12.

These options are shared by several Target types and their details can be viewed by clicking Shared Options.

13. Click Next to proceed, Previous to return to the previous screen, or Exit Without Saving
to discard.

14. The Select Exchange / Outlook options screen displays options specific to Exchange and Outlook.

15.

The Exchange and Outlook options are described in Shared Options.

16. Click Next to proceed, Previous to return to the previous screen, or Exit Without Saving
to discard.

17. The Select advanced options screen opens.

18.

These options are shared by several Target types and their details can be viewed by clicking Shared Options.

19. Click Next to proceed, Previous to return to the previous screen, or Exit Without Saving
to discard.

20. On the Discovery Team Settings screen, select the desired settings.

Note: The screen only displays when multiple On-prem agents are selected.

a. Agent 13.0+: Ensure these ports are open.

Port 5672: Use these settings:
- Open for Inbound TCP communication on the Discovery Agent.
- Open for Outbound TCP communication on ALL other agents involved in the same scan to the Discovery Agent.

Note: This communication is for reading and writing information to the message queue.

Port 15672: Use these settings:
- Open for Inbound TCP communication on the Discovery Agent.
- Open for Outbound TCP communication on ALL other agents involved in the same scan to the Discovery Agent.

Note: This is for the Message Queue Management Interface and API.

b. Agent 13.2+: Ensure these ports are open.

Ports 5671 & 5672: Use the following settings:

Open for Inbound TCP communication on the Discovery Agent.

Open for Outbound TCP communication on ALL other agents involved in the same scan to the Discovery Agent.

Note: This communication is for reading and writing information to the message queue.

Ports 15671 & 15672: Use these settings:

Open for Inbound TCP communication on the Discovery Agent.

Open for Outbound TCP communication on ALL other agents involved in the same scan to the Discovery Agent.

Note: This is for the Message Queue Management Interface and API.

c. Discovery Agent: Select an agent from the drop-down list.

d. Configure Agent IPs: If your organization requires it, you can set a specific IP address.

Click Configure Agent IP's.

In the Add New IP Address field, enter the new IP address and click the plus icon.

Hover over the new IP address more options menu and click Make Default.

Click Save to apply or Cancel to discard.

e. For Agent 13.0 and legacy Agents, choose from these options:

1) The details for the Discovery Team Settings options are included in Shared Options.

21. Click Next to proceed, Previous to return to the previous screen, or Exit Without Saving
to discard.

22. The next screen is the Select the scan schedule screen. To set up date, time, and / or recurrence, click Select Date and Time.

23. Click Next to proceed, Previous to return to the previous screen, or Exit Without Saving
to discard.

24. On the Who should receive notification of scan completion screen, select how to send email notifications.

f. I'll Manually Check My Scans Results

g. Send a Notification

1) To send notification, select a user from the drop-down or enter an email address and click Enter.

1) To add additional email addresses, click the plus (+) icon and select or enter the email addresses in the entry field and click Enter.

25. Click Next to proceed, Previous to return to the previous screen, or Exit Without Saving
to discard.

26. On the Summary screen, select the ˅ icon to open and review your scan settings.

27.

28. Use the edit icon link to jump to a specific screen to edit a setting.

29.

30. Click Finish & Save to add the new Scan, Previous to return to the previous screen, or Exit Without Saving to discard.

Exchange Online

When you select Exchange Online as the email provider to scan, the Select the agent(s) to perform the scan screen opens. Choose the agents you want to use. Click the chevron (>) to expand an entry in the list.

a. To add an agent from the All On-Prem Agents list to the Selected On-Prem Agents list, click the arrow next to the agent name in the All On-Prem Agents list.

b. To move an agent from the Selected On-Prem Agents list back to the All On-Prem Agents list, click the arrow next to the agent name.

31. Click Next to proceed, Previous to return to the previous screen, or Exit Without Saving
to discard.

32. On the Select the target(s) to scan screen, click the chevron (>) to expand the entries in the All Targets list.

a. To add a target from the All Targets list to the Selected Targets list, click the arrow next to the target name in the All Targets list. The target moves to the Selected Targets list. To move the target back to the All Targets list, click the arrow next to the target name in the Selected Targets list.

33. Click Next to proceed, Previous to return to the previous screen, or Exit Without Saving
to discard.

34. On the Select accounts to scan screen, check the Scan Attachments check box, if applicable. You can also type account names into the entry field and then click Enter.

35.

Note: If you do not specify user accounts, by default, all user accounts are scanned.

a. To upload multiple accounts:

1) Click Upload Account List.

2) From your computer, locate and select the .csv file with the accounts to include. Select Open.

3) The user accounts are displayed in the entry field.

36. Click Next to proceed, Previous to return to the previous screen, or Exit Without Saving
to discard.

37. On the Select file type scan options screen, select from these Basic Options. Click the Advanced Options button at the top, right corner of this screen to access additional options. You can toggle back and forth between these screens using this button.

38.

a. When you click the Advanced Options button, the Select file type scan options - Advanced Options screen opens.

1) The Basic and Advanced Options are both shared among the Target types and details are available by clicking, Shared Options.

c. Click Next to proceed, Previous to return to the previous screen, or Exit Without Saving
to discard.

d. The next screen is the Select advanced options.

e. Details about these options can be viewed by clicking Shared Options.

39. Click Next to proceed, Previous to return to the previous screen, or Exit Without Saving
to discard.

40. On the Discovery Team Settings screen, select from the displayed options.

41.

Note: The screen only displays when multiple On-Prem agents are selected.

a. Agent 13.0+: Ensure these ports are open.

Port 5672: Use these settings:
- Open for Inbound TCP communication on the Discovery Agent.
- Open for Outbound TCP communication on ALL other agents involved in the same scan to the Discovery Agent.
  
  Note: This communication is for reading and writing information to the message queue.

Port 15672: Use these settings:
- Open for Inbound TCP communication on the Discovery Agent.
- Open for Outbound TCP communication on ALL other agents involved in the same scan to the Discovery Agent.

Note: This is for the Message Queue Management Interface and API.

b. Agent 13.2+: Ensure these ports are open.

Ports 5671 & 5672: Use these settings:

Open for Inbound TCP communication on the Discovery Agent.

Open for Outbound TCP communication on ALL other agents involved in the same scan to the Discovery Agent.

Note: This communication is for reading and writing information to the message queue.

Ports 15671 & 15672: Use these settings:

Open for Inbound TCP communication on the Discovery Agent.

Open for Outbound TCP communication on ALL other agents involved in the same scan to the Discovery Agent.

Note: This is for the Message Queue Management Interface and API.

c. Discovery Agent: Select an agent from the drop-down list.

d. Configure Agent IPs: If your organization requires it, you can set a specific IP address.

1) In the Add New IP Address field, enter the new IP address and click the plus icon.

2) Hover over the new IP address More options menu and click Make Default.

3) Click Save to apply or Cancel to discard.

Agent 13.0 and legacy Agents: select from these options.

To access details about these options click Shared Options.

Click Next to proceed, Previous to return to the previous screen, or Exit Without Saving
to discard.

42. The next screen is the Select the scan schedule screen. To set up date, time, and / or recurrence, click Select Date and Time.

43. Click Next to proceed, Previous to return to the previous screen, or Exit Without Saving
to discard.

44. On the Who should receive notification of scan completion screen, select how to send email notifications.

I'll Manually Check My Scans Results
Send An Email Notification

b. To send notification, select a user from the drop-down list or enter an email address in the entry field and click Enter.

c. To add additional email addresses, click the plus (+) icon and select or enter the email addresses in the entry field.

45. Click Next to proceed, Previous to return to the previous screen, or Exit Without Saving
to discard.

46. On the Summary screen, select the ˅ icon to open and review your scan settings,

47.

48. Use a edit icon link to jump to a specific screen to edit a setting.

49.

50. Click Finish & Save to add the new Scan, Previous to return to the previous screen, or Exit Without Saving to discard.

Gmail

1. When you select the email provider Gmail, the Select the agent(s) to perform the scan screen opens. Choose the agents you want to use for your scan. Click the chevron (>) to expand the entries in the lists.

a. To add an agent from the All On-Prem Agents list to the Selected On-Prem Agents list, click the arrow next to the agent name in the All On-Prem Agents list.

b. To move the agent back from the Selected On-Prem Agents list to the All On-Prem Agents list, click the arrow next to the agent name.

2. Click Next to proceed, Previous to return to the previous screen, or Exit Without Saving
to discard.

3. On the Select the target(s) to scan screen click the chevron (>) to expand the listed targets.

a. To add target(s) from the All Targets list to the Selected Targets list, click the arrow next to the target name.

b. To move a target back from the Selected Targets list back to the All Targets list, click the arrow next to the target name.

4. Click Next to proceed, Previous to return to the previous screen, or Exit Without Saving
to discard.

5. On the Select accounts to scan screen, check the box next to Select Scan Attachments, if applicable.

a. To add user accounts:

Type the user account name in the entry field and click Enter.

Search for the user account name.

b. To upload multiple accounts, click Upload Account List.

4) Locate and select the .csv file with the accounts.

5) The user accounts are displayed in the entry field.

6. Click Next to proceed, Previous to return to the previous screen, or Exit Without Saving
to discard.

7. On the Select file type scan options screen, the Basic Options display.

These are the Basic Options for scans. They are shared and available for Cloud, Files & Folders (Local & Remote), Email, Collaboration Tools and Website Target types. They are not available for the Database Target type.

Since the Basic Options are shared, they are detailed and described in the link Shared Options. Click the link for details on these options.

9. Click Next to proceed, Previous to return to the previous screen, or Exit Without Saving
to discard.

10. From the Basic Options screen, select the Advanced Options button in the top, right corner of the screen. Additional options display.

11.

a. Details about these Advanced Options can be viewed by clicking Shared Options.

12. Click Next to proceed, Previous to return to the previous screen, or Exit Without Saving
to discard.

13. Additional options are available on the Select advanced options screen.

14.

To access details about these additional Advanced Options click Shared Options.

15. Click Next to proceed, Previous to return to the previous screen, or Exit Without Saving
to discard.

16. On the Discovery Team Settings screen, based on your Agent version, use the desired settings.

Note: The screen only displays when multiple On-Prem agents are selected.

b. Agent 13.0+: Ensure these ports are open.

Port 5672: Use these settings:
- Open for Inbound TCP communication on the Discovery Agent.
- Open for Outbound TCP communication on ALL other agents involved in the same scan to the Discovery Agent.

Note: This communication is for reading and writing information to the message queue.

Port 15672: Use these settings:
- Open for Inbound TCP communication on the Discovery Agent.
- Open for Outbound TCP communication on ALL other agents involved in the same scan to the Discovery Agent.

Note: This is for the Message Queue Management Interface and API.

c. Agent 13.2+: Ensure these ports are open.

Ports 5671 & 5672: Use the following settings:

Open for Inbound TCP communication on the Discovery Agent.

Open for Outbound TCP communication on ALL other agents involved in the same scan to the Discovery Agent.

Note: This communication is for reading and writing information to the message queue.

Ports 15671 & 15672: Use these settings:

Open for Inbound TCP communication on the Discovery Agent.

Open for Outbound TCP communication on ALL other agents involved in the same scan to the Discovery Agent.

Note: This is for the Message Queue Management Interface and API.

d. Discovery Agent: Select an agent from the drop-down list.

a. Configure Agent IPs: If your organization requires it, you can set a specific IP address.

1) In the Add New IP Address entry field, type the new IP address and click the plus icon.

2) Hover over the new IP address more options menu and click Make Default.

3) Click Save to apply or Cancel to discard.

a. Agent 13.0 and legacy Agents: Select from these options.

To access details about these options click Shared Options.

17. Click Next to proceed, Previous to return to the previous screen, or Exit Without Saving
to discard.

18. The next screen is the Select the scan schedule screen. To set up date, time, and / or recurrence, click Select Date and Time.

19. Click Next to proceed, Previous to return to the previous screen, or Exit Without Saving
to discard.

20. On the Who should receive notification of scan completion screen, select how to send email notifications.

b. I'll Manually Check My Scans Results

c. Send a Notification

1) To send notification, select a user from the drop-down list or enter an email address and click Enter.

2) To add additional email addresses, click the plus (+) icon and select or type the email addresses in the entry field.

21. Click Next to proceed, Previous to return to the previous screen, or Exit Without Saving
to discard.

22. On the Summary screen, select the ˅ icon to open and review your scan settings.

23.

24. Use the edit icon link to jump to a specific screen to edit a setting.

25.

26. Click Finish & Save to add the new Scan, Previous to return to the previous screen, or Exit Without Saving to discard.

Create a Collaboration Tools Scan

1. Click the Collaboration Tools tile.

2. Click Next to proceed, Previous to return to the previous screen, or Exit Without Saving
to discard.

3. On the Select the collaboration tool to scan screen, select either:

SharePoint | SharePoint Online
Bitbucket

4. Expand a section for more information.

SharePoint | SharePoint Online

1. After selecting the collaboration tool SharePoint, the Select the agent(s) to perform the scan screen opens. Choose the agents you want to use for your scan. Click the chevron (>) to expand the agent listing.

a. To add an agent from the All On-Prem Agents list to the Selected On-Prem Agents list, click the arrow next to the agent name in the All On-Prem Agents list

b. To move an agent back from the Selected On-Prem Agents list back to the All On-Prem Agents list, click the arrow next to the agent name.

2. Click Next to proceed, Previous to return to the previous screen, or Exit Without Saving
to discard.

3. On the Select the target(s) to scan screen click the chevron (>) to expand the target listing.

a. To add target(s) from the All Targets list to the Selected Targets list, click the arrow next to the target name in the All Targets list.

b. To move a target from the Selected Targets list back to the All Targets list, click the arrow next to the target name.

4. Click Next to proceed, Previous to return to the previous screen, or Exit Without Saving
to discard.

5. On the Select SharePoint options screen, select all applicable options.

Search this SharePoint Site Content

Select the types to search within SharePoint sites.

Specify the search types to include or exclude when searching SharePoint sites. By default, searching of all file types in the SharePoint document library is enabled. Alternately, searches can be enabled for tasks, calendar events, or contacts that have been synchronized with Outlook or input into SharePoint.

When using this setting outside of the console, note that the value for this setting is a bitmask of the logical OR of any of these values. When created in the Windows Registry, they are of type REG_DWORD. When entered into the Windows Registry or a configuration XML file, they should be entered as hexadecimal values. When entered into a security template (.inf) file, they should be entered in decimal.

Name	Value	Default
Documents/Files	0x00000001	On
Tasks	0x00000002	Off
Calendar	0x00000004	Off
Contacts	0x00000008	Off
Item	0x00000010	Off

6. Click Advanced Options button for more options.

7. Click Next to proceed, Previous to return to the previous screen, or Exit Without Saving
to discard.

8. On the Select advanced SharePoint options, select the settings to use.

SSL Settings

The SSL settings to use when searching SharePoint sites.

Ignore untrusted root: Continue searching if the root certificate of the SSL chain is not currently in the trust store.

Ignore invalid date: Continue searching if the SSL certificate for the URL has an invalid or expired date.

Ignore mismatched CN: Continue searching if the domain name on the SSL certificate does not match the URL configuration.

Ignore incorrect usage: Continue searching if the SSL certificate is intended for a purpose other than verifying the identity of the sender and encrypting server communications.

Name	Value	Default
Ignore untrusted root	0x00000001	False
Ignore invalid date	0x00000002	False
Ignore mismatched CN	0x00000004	False

9. Click Next to proceed, Previous to return to the previous screen, or Exit Without Saving
to discard.

10. On the Select file type scan options - Advanced Options, select the options you need.

11.

These Advanced Options are shared with the Target types, except the Database Target type. To access details about the Advanced Options click Shared Options.

c. Click Next to proceed, Previous to return to the previous screen, or Exit Without Saving
to discard.

12. On the Select advanced options screen, choose from the additional options.

13.

d. These are options shared across Target Types with the exclusion of the Database Target type. To view details, click Shared Options.

a. Click Next to proceed, Previous to return to the previous screen, or Exit Without Saving
to discard.

14. On the Discovery Team Settings screen, choose the applicable options.

Note: The screen only displays when multiple On-Prem agents are selected.

a. Agent 13.1 and above:

3) Discovery Agent: Select an agent from the drop-down list.

4) Configure Agent IPs: If your organization requires it, you can set a specific IP address.

Click Configure Agent IP's.
In the Add New IP Address entry field, type the new IP address and click the plus icon.
Hover over the new IP address more options menu and click Make Default.
Click Save to apply or Cancel to discard.

b. For Agent 13.0 and legacy Agents, select from the options displayed.

c. These are options shared across Target Types. To view details, click Shared Options.

15. Click Next to proceed, Previous to return to the previous screen, or Exit Without Saving
to discard.

16. The next screen is the Select the scan schedule screen. To see how to set up date, time, and / or recurrence, click Select Date and Time.

17. Click Next to proceed, Previous to return to the previous screen, or Exit Without Saving
to discard.

18. On the Who should receive notification of scan completion screen, select how to send email notifications.

I'll Manually Check My Scans Results
Send An Email Notification:

e. To send notification, select a user from the drop-down list and / or type an email address in the entry field and click Enter.

f. To add additional addresses, click the plus (+) icon and select or type the email addresses in the entry field.

19. Click Next to proceed, Previous to return to the previous screen, or Exit Without Saving
to discard.

20. On the Summary screen, select the ˅ icon to open and review your scan settings.

21.

22. Use the edit icon link to jump to a specific screen to edit a setting.

23.

24. Click Finish & Save to add the new Scan, Previous to return to the previous screen, or Exit Without Saving to discard.

Bitbucket

1. On the Select the agent(s) to perform the scan screen, choose the agents you want to use for your scan. Click the chevron (>) to expand the listed agent sections.

a. To add an agent from the All On-Prem Agents list to the Selected On-Prem Agents list, click the arrow next to the agent name.

b. To move an agent from the Selected On-Prem Agents list back to the All On-Prem Agents list, click the arrow next to the agent name.

2. Click Next to proceed, Previous to return to the previous screen, or Exit Without Saving
to discard.

1. On the Select the targets(s) to scan screen, choose the targets you want to use for your scan. Click the chevron (>) to expand the target listings.

c. To add an target from the All Targets list to the Selected Targets list, click the arrow next to the target name.

a. To move the target(s) from the Selected Targets list back to the All Targets list, click the arrow next to the target name.

2. Click Next to proceed, Previous to return to the previous screen, or Exit Without Saving
to discard.

3. On the Select file type scan options screen, select from the displayed options.

Since the Basic Options are shared, they are detailed and described in the link Shared Options. Click the link for details on these options.

If applicable, click Advanced Options button to view additional options. The button label changes to Basic Options. Click the Basic Options button to return to the previous screen.

4. Click Next to proceed, Previous to return to the previous screen, or Exit Without Saving
to discard.

5. On the Select file type scan options - Advanced Options, choose from the options:

These Advanced Options are shared by several Target types, except the Database Target type. To access details about these options click Shared Options.

7. Click Next to proceed, Previous to return to the previous screen, or Exit Without Saving
to discard.

8. On the Select advanced options screen, you can use these additional options.

a. These Advanced Options are also shared and are described and detailed in Shared Options.

10. Click Next to proceed, Previous to return to the previous screen, or Exit Without Saving
to discard.

11. On the Select Discovery Team settings screen, select the desired options.

Note: Discovery Team Settings only applies when multiple agents are assigned to a scan at runtime.

a. Agent 13.1 and above:

5) Discovery Agent: Select an agent from the drop-down list.

6) Configure Agent IPs: If your organization requires it, you can set a specific IP address.

Click Configure Agent IP's.

In the Add New IP Address field, type the new IP address and click the plus icon.

Hover over the new IP address more options menu and click Make Default.

Click Save to apply or Cancel to discard.

b. Agent 13.0 and legacy Agents: Select from the following:

1) These options are shared across Target types, except for the Database Target type. They are described and detailed in Shared Options

12. Click Next to proceed, Previous to return to the previous screen, or Exit Without Saving
to discard.

13. The next screen is the Select the scan schedule screen. To set up date, time, and / or recurrence, see Select Date and Time.

14. Click Next to proceed, Previous to return to the previous screen, or Exit Without Saving
to discard.

15. On the Select who should receive notification of scan completion screen, select how to send email notifications:

I'll Manually Check My Scans Results

Send An Email Notification

To send notification, select a user from the drop-down list or type an email address in the entry field and click Enter.

b. To add additional email addresses, click the plus (+) icon and select or type the email addresses in the entry field.

16. Click Next to proceed, Previous to return to the previous screen, or Exit Without Saving
to discard.

17. On the Summary screen, select the ˅ icon to open and review your scan settings.

18.

19. Click the edit icon link in a section and jump to a specific screen to edit a setting.

20.

21. Click Finish & Save to add the new Scan, Previous to return to the previous screen, or Exit Without Saving to discard.

Create a Database Scan

Note: To establish the connection required to scan a database target, the relevant driver must be installed on the agent host system

1. Click the Database tile.

2. On the Select which database to search screen, click a database type tile to use.

Oracle
SQL Server

Sybase
IBM DB2
Informix
InterBase
SQLBase
SAP SQL Anywhere

MySQL
SQLite
PostgreSQL
ODBC
OLEDB
mongoDB
Snowflake

4. Click Next to proceed, Previous to return to the previous screen, or Exit Without Saving
to discard.

5. On the Select the agent(s) to perform the scan screen, to expand the listed targets use the chevron (>) icon.

a. To select an agent, click the arrow next to the agent name and move the agent from the All On-Prem Agents list to the Selected All-Prem Agents list.

b. To move an agent from the Selected On-Prem Agents list back to the All On-Prem Agents list, click the arrow next to the agent name.

6. Click Next to proceed, Previous to return to the previous screen, or Exit Without Saving
to discard.

7. On the Select the target(s) to scan screen, select the chevron (>) to expand the target listing.

a. To select an target, click the arrow next to the target name in the All Targets list and move it to the Selected Targets list.

b. To move the target(s) from the Selected Target list back to the All Targets list, click the arrow next to the target name.

8. Click Next to proceed, Previous to return to the previous screen, or Exit Without Saving
to discard.

9. The Select SQL Advanced Options screen displays.

SQL Advanced Options

Include Primary Key Data - If a database includes a Primary Key column, it is possible to return the data in the cell of the Primary Key column for the row in which a result was found. The data will be displayed in the Preview window along with the list of columns in which the result was found. To include the Primary Key data, set this to "Include Primary Key data" (1).

Do not include Primary Key Data - This is the default setting for Primary Key Data.

Set Non-Matching cells limit - When searching structured data (files or databases searched via a connection string), the endpoint application will look within a column for data that matches the specified data type. After a specified number of cells in that column are searched without finding any matches, the search will move on to the next column. The counter is started at the first row and continues until the limit is hit or a match is found. If a match is found, all subsequent rows in that column will be searched. To disable this limit and search all cells, use a value of 0.

Exclude Column Types - Specify which column types are excluded when searching databases.

Description	Value	Default
Exclude Integer Types	0x00000001	Off
Exclude Double Types	0x00000002	Off
Exclude DateTime Types	0x00000004	Off
Exclude String Types	0x00000008	Off
Exclude Blob Types	0x00000010	Off
Exclude Cursor Types	0x00000020	Off

Log Level - When searching databases via the Database Search Module, it is desirable to see detailed logging information during configuration or troubleshooting. The logging specified via this setting only applies when logging has been enabled and only specific log entries are displayed if their corresponding log type has been enabled (for example, Info, Error)

The following log levels are available:

0 (Default): Standard logging: Includes basic information such as the name of the table being searched and errors.

1: Additional logging: Standard logging plus information about the status of the search for the current row.

2: Comprehensive logging: Additional logging plus details about each table, column and row.

3: Debug logging: Comprehensive logging plus the actual cell data for each cell searched.

Note: Data from the database is written in clear text to the client log file.

4: Full logging: Data from the database will be written in clear text to the client log file.

Note: Logging beyond the default level, especially the maximum level, creates very large log files and may contain sensitive information.

Row Count Start - Logging - When the setting Settings\Locations\Databases\LogLevel is set to 1, it is possible to specify a row at which additional, detailed column information can be logged. To enable this logging, specify the row number at which to start. This setting should only be set after consulting with the Support Team.

Row Count Start - The row number at which to start detailed column logging: When the setting Settings\Locations\Databases\LogLevel is set to 1, it is possible to specify a row at which additional, detailed column information can be logged. To enable this logging, specify the row number at which to start. This setting should only be set after consulting with the Support Team.

Row Count Stop - By default, all rows in a target database is searched. To specify the maximum number of rows to search in each table, set this to a value greater than 0. Once that number of rows have been searched, the search of that table will be stopped and searching resumes with the next appropriate table.

Scan Column Names - By default, all columns in a specified database are searched. To search only specific columns, enter those table names, one per line. The column name list applies to all databases configured to be searched.

By default, the comparison of column names requires an exact match. To allow a partial match, set ColumnMatchType.

To use this list as a list of columns to exclude from the search, set SearchColumnNamesIsExcludeList.

Require exact match - By default, the comparison of column names requires an exact match. To allow a partial match, set ColumnMatchType.

Allow partial match - By default, all columns in a specified database are searched. To search only specific columns, enter those table names, one per line. The column name list applies to all databases configured to be searched.

By default, the comparison of column names requires an exact match. To allow a partial match, set ColumnMatchType.

To use this list as a list of columns to exclude from the search, set SearchColumnNamesIsExcludeList.

Include/Exclude Columns (check to exclude) - By default, the column names listed in SearchColumnNames must match exactly to be included or excluded from the search. To allow partial matching - for example allowing the value zip (when specified in SearchColumnNames) to match the column ZipCodes, set this to "Allow partial match" (1). By default, the comparison of column names requires an exact match. To allow a partial match, set ColumnMatchType.

Column Names to Include/Exclude(Entry Field) - By default, when SearchColumnNames is used to specify specific column names, only those columns are included in the search. To search all columns except those specified in SearchColumnNames, set this to "Exclude list" (1).

By default, all columns in a specified database are searched. To search only specific columns, enter those table names, one per line. The column name list applies to all databases configured to be searched.

To use this list as a list of columns to exclude from the search, set the SearchColumnNamesIsExcludeList option.

Scan Table Names - By default, all tables in a specified database are searched. To search only specific tables, enter those table names, one per line. The table name list applies to all databases configured to be searched.

By default, the comparison of table names requires an exact match. To allow a partial match, set TableMatchType.

Require exact match - By default, the comparison of table names requires an exact match. To allow a partial match, set TableMatchType.

By default, the comparison of column names requires an exact match. To allow a partial match, set ColumnMatchType.

To use this list as a list of columns to exclude from the search, set SearchColumnNamesIsExcludeList.

Include/Exclude Tables (Check to exclude) - To use this list as a list of tables to exclude from the search, set SearchTableNamesIsExcludeList.

Table Names to Include/Exclude (Entry Field) - By default, all tables in a specified database are searched. To search only specific tables, enter those table names, one per line. The table name list applies to all databases configured to be searched.

By default, the comparison of table names requires an exact match. To allow a partial match, set TableMatchType.

To use this list as a list of tables to exclude from the search, set the SearchTableNamesIsExcludeList option.

Scan Table Types - Specify whether tables or views is included when searching databases. When using this setting outside of the console, note that the value for this setting is a bitmask of the logical OR of any of these values. When created in the Windows Registry, they are of type REG_DWORD. When entered into the Windows Registry or a configuration XML file, they need to be entered as hexadecimal values. When entered into a security template (.inf) file, they need to be entered in decimal.

Description	Value	Default
Include Tables	0x00000001	On
Include Views	0x00000002	Off

Include Tables

Include Views

Database Preview Length - To provide context to matches when viewing results on the console, version 10.7 and later of the endpoints and console can send the specified number of characters from before and after the match itself. By default, no characters preceding or following database matches will be sent to the console. The maximum allowed number of characters is 1000 and a value of 0 will disable sending preview information to the console.

Valid values:

0: Disabled (no preview data will be sent to the console)

1-1000: The specified number of characters from before and after the database match will be sent to the console

>1000: Invalid (the value will be set back to the default of 20)

Note: When Console\sendMatch is set to Disable (0), preview information will not be sent to the console.

Database Preview Match Max - Specify the maximum number of unique keyword matches in a location to consider all of the keyword matches as part of the results for that location. If the number of unique keyword matches exceeds the value of this setting, then the matches will not be included in the results for this location.

This setting is only read if there are keywords configured as part of the custom type search. When using keyword custom type searches, this value can be used in conjunction with the CustomKeywords\minRequired setting to refine the results. The default value of zero (0) specifies that there is no maximum and that all keyword matches should be included in the results. To set a maximum, specify the number in this setting.

Example:

Five unique keywords are configured:

Keyword Names	Keyword
KeyName1	Key1
KeyName2	Key2
KeyName3	Key3
KeyName4	Key4
KeyName5	Key5

maxAllowed = 3

For a location, "Key1" and "Key2" are matched, those matches are included in the results for the location. For a location, "Key1","Key2","Key3", and "Key4" are matched, none of those matches are included in the results for the location.

When the mongoDB database is selected to scan, the NoSQL Advanced Options display instead of the Select SQL Advanced Options screen.

NoSQL Advanced Options (MongoDB only)

This table lists the NoSQL Advanced Options (MongoDB only).

Name

Description

Admin Databases

Exclude Administrative Databases from NoSQL Database searches:

Include Default Admin Databases
Exclude Default Admin Databases (Default)

By default, Administrative NoSQL databases will be included in the NoSQL search. To exclude Administrative databases, set this to "Include Default Admin Databases" (0).

File Attachment Min Size

By default, file attachments of any size will be searched. To skip file attachments smaller than a specified size, specify that size in bytes.

File Attachment Max Size

By default, file attachments of any size will be searched. To skip file attachments larger than a specified size, specify that size in bytes.

Record Count Stop

After the specified number of records in a store are searched without finding any matches, the search will move on to the next store. The counter is started at the first record and continues until the limit is hit or a match is found. If a match is found, all subsequent records in that store will be searched. To disable this limit and search all records, set this to 0.

Record Min Size

By default, records of any size will be searched. To skip records smaller than a specified size, specify that size in bytes.

Record Max Size

By default, records of any size will be searched. To skip records larger than a specified size, specify that size in bytes.

Store Min Size

By default, stores of any size will be searched. To skip stores smaller than a specified size, specify that size in bytes.

Store Max Size

By default, stores of any size will be searched. To skip stores larger than a specified size, specify that size in bytes.

Database Min Size

By default, databases of any size will be searched. To skip databases smaller than a specified size, specify that size in bytes.

Database Max Size

By default, databases of any size will be searched. To skip databases larger than a specified size, specify that size in bytes.

Database Names

By default, all database(s) will be searched. To search only specific database(s), enter those database name(s), one per line. The database name list will apply to all NoSQL server(s) configured to be searched.

By default, the comparison of database names requires an exact match. To allow a partial match, set the DatabaseNamesMatchType setting.

To use this list as a list of databases to exclude from the search, set the DatabaseNamesIsExcludeList setting.

Store Names

By default, all stores in a specified database will be searched. To search only specific stores, enter those store names, one per line. The store name list will apply to all databases configured to be searched.

By default, the comparison of store names requires an exact match. To allow a partial match, set the StoreNamesMatchType setting.

To use this list as a list of stores to exclude from the search, set the StoreNamesIsExcludeList setting.

Label Names

By default, all document labels will be searched. To search only specific labels, enter those label names, one per line. The label name list filtering criteria will apply to every document searched. By default, the comparison of label names requires an exact match. To allow a partial match, set the LabelNamesMatchType setting. To use this list as a list of labels to exclude from the search, set the LabelNamesIsExcludeList setting.

10. Click Next to proceed, Previous to return to the previous screen, or Exit Without Saving
to discard.

11. On the Select advanced options screen, select the applicable options.

12.

a. These Advanced Options are shared with the Target types, and details can be seen by clicking Shared Options.

13. Click Next to proceed, Previous to return to the previous screen, or Exit Without Saving
to discard.

14. On the Discovery Team Settings screen, choose from the displayed options.

Note: Discovery Team Settings only applies when multiple agents are assigned to a scan at runtime.

a. Agent 13.2+: Ensure these ports are open.

Ports 5671 & 5672: Use these settings:

Open for Inbound TCP communication on the Discovery Agent.

Open for Outbound TCP communication on ALL other agents involved in the same scan to the Discovery Agent.

Note: This communication is for reading and writing information to the message queue.

Ports 15671 & 15672: Use these settings:

Open for Inbound TCP communication on the Discovery Agent.

Open for Outbound TCP communication on ALL other agents involved in the same scan to the Discovery Agent.

Note: This is for the Message Queue Management Interface and API.

b. Discovery Agent: Select an agent from the drop-down list.

c. Configure Agent IPs: If your organization requires it, you can set a specific IP address.

1) Click Configure Agent IP's.

2) In the Add New IP Address field, type the new IP address and click the plus icon.

3) Hover over the new IP address more options menu and click Make Default.

4) Click Save to apply or Cancel to discard.

d. For Agent 13.0 and legacy Agents: Choose from these options:

These Discovery Team options are detailed in Shared Options.

15. Click Next to proceed, Previous to return to the previous screen, or Exit Without Saving
to discard.

16. The next screen is the Select the scan schedule screen. To set up date, time, and / or recurrence, see Select Date and Time.

17. Click Next to proceed, Previous to return to the previous screen, or Exit Without Saving
to discard.

18. On the Select who should receive notification of scan completion screen, select how to send email notifications.

I'll Manually Check My Scans Results

Send An Email Notification

19.

20. To send notification, select a user from the drop-down list or type an email address in the entry field and click Enter.

21. To add additional email addresses, click the plus (+) icon and select or type the addresses in the entry field.

22. Click Next to proceed, Previous to return to the previous screen, or Exit Without Saving
to discard.

23. On the Summary screen, select the ˅ icon next to a section to open and review your scan settings.

24.

25. Use the edit icon link to jump to a specific screen to edit a setting.

26.

27. Click Finish & Save to add the new Scan, Previous to return to the previous screen, or Exit Without Saving to discard.

User Guide

Create a New Sensitive Data Scan

Target Type Options