Working with Scans

To access Scans:

1. From the left menu, click Scans.

2. Click All Scans.

3. You can view by All Scans, Discovery Scans, or Sensitive Data Scans. Click a tab to change the view.

4. Scans are displayed by column:

• Name

• Status

• Agents

• Targets(s) Scanned

• Next Run

• Last Run

• Scan Owner

• More options (Note: options can vary depending on the scan status.)

  • View Scan Results

  • Run Scan Now

  • Manage Scan

  • Clone Scan

  • Delete Scan

To search for a specific Scan:

1. Type a column name in the search box. For example, search for a scan name.

2. The search results are displayed in the scans table below.

Select the type of scan and complete the Scan Configuration wizard using these guides:

• Create a New Discovery Scan

• Create a New Sensitive Data Scan

Note: When you create a scan and select options for excluding files or settings for maximum file sizes, all Target types except DropBox use your selected configurations so that scan times are improved.

• The default view of results from a specific scan condensed by location. As a result, the default itemization of the Scan Results table is locations with matches, which includes summary information of the location’s data type(s), match count, and playbook action(s).

• Each location can be expanded to view its matches. This launches a modal containing details for individual matches, including the match string itself, and options for user level remediation (ULR).

• Options for ULR actions emphasize the difference between location-level and match-level actions, as explained in the following section.

• The traditional match view is still available and can be toggled to by clicking on Total Match Count next to the Actions button. The option to View Scan Results by Location is nested under the Actions button.

To view Scan Results:

1. From the All Scans page, locate the Scan you want to view.

2. From the kebab menu, select View Scan Results. You can alternatively filter to a subset of matches from the Scan Results page.

• Itemization by location is confirmed by the following:

  • Total Match Count listed at the top-right of the screen, next to the Actions button.

  • Clicking this toggles to results itemized by match.

• The Location column has an expansion icon:

  • Clicking this opens the ULR modal including match data.

Note: For database targets, the column name is in the match info tool tip, accessed by clicking the i next to a match.

• The URL of a location-based results table ends in “/scans/results”

• The URL of a match-based results table ends in “/scans/results-alt”

  • As noted above, clicking the Total Match Count button lists results itemized by match.

• There is also a View Scan Results by Match option accessible from the Actions button.

• Returning to Results by Location

  • From the Actions button, select View Scan Results by Location.

Agent 13 and Above

If Agent 13 or above is installed, the Status column will display the status of the scan and the available options in a drop-down list:

• Scanning

  • View Details

• Scanning, With Results

  • View Details

  • View Results

• Done, With Results

  • View Details

  • View Results

• Done, No Results

  • View Details

View Details

To view the details of a Scan:

1. From the Status column, click the drop-down list of the Scan Details you want to view.

2. Click View Details.

3. The Scan Status pop-up window displays:

• Scan Name

• Status

• Total Locations

• Endpoint

• Locations

• Status

• Last Updated
  

View Results

To view the Results of a Scan:

1. From the Status column, click the drop-down list of the Scan Results you want to view.

2. Click View Scan Results.

3. The Scan Results screen is displayed.

When viewing results by location, the location string has a diagonal-arrow icon next to it that launches the modal containing User Level Remediation controls. Depending on the location and file type, unsupported actions will be greyed out and cannot be selected. There are two levels of remediation to consider:

• Location: Actions are applied to the entire location (shred, quarantine, classify, restrict access, redact, ignore).

• Match: Actions are applied to specific matches (redact, ignore, etc.).

There are also two types of actions to consider:

• Instant: Actions are resolved immediately (database-only classification, ignore).

• Agent Resolved: Actions are pushed to the agent to be completed (everything else).

It's important to note the following:

• Actions triggered by ULR controls show up in the audit log once completed, with an action history also available directly in the Scan Results table that is viewed by clicking the i icon in the corresponding column.

• ULR also introduces a centrally managed ignore list for agent-specific or global exclusions based on location or match result. The remaining ULR actions adhere to the values set globally in the console (quarantine/redact) or locally in an agent policy (shred).

The ULR actions described in the subsequent sections two types of playbooks:

• Incomplete (manual action) playbook decisions:

  • Scan results indicating User Action/Intervention Required will resolve with a status of Overridden.

• Complete (automatic action) playbook decisions:

  • Scan results indicating Complete will resolve with a status of Complete, Overridden.

Location Actions:

1. Viewing results by location, select the diagonal-arrow icon next to any location path.

2. Select any of the relevant Location Actions at the top of the resulting modal:

a. Shred, Quarantine, & Redact: Displays a confirmation prompt indicating action cannot be undone.

Note: Redacting at the location level redacts all applicable matches found in the file; controls to redact individual matches are explained in the following section.

b. Classify & MIP Label: Displays pulldown menus with available classifications.

c. Restrict Access: Displays a prompt for which built-in accounts should retain access.

d. Ignore: Displays option to ignore the location for the agent that completed the scan (discovering Agent) or globally (all Agents).

3. Once applied in the console, the action is queued for execution.

Note: Agent resolved actions require the agent to be online to complete; instant actions are resolved immediately. See the description above for details.

a. When successful, actions move from Queued (received) to Processing (attempted) to Most Recent: <Action>.

b. If the action fails, it will be noted in the EPS logs.

Match Actions:

a. Viewing results by location, select the diagonal-arrow icon next to any location path.

b. Select the desired remediation outcome from the User Action column, which populates with choices (redact and/or ignore) dynamically based on the target location and file type.

c. Counts for each selected action populates under Match Actions.

d. The action(s) trigger upon clicking the button corresponding to the intended outcome:

• Ignore: Displays option to ignore the selected match(es) for the agent that completed the scan (discovering Agent) or globally (all Agent”).

• Redact: Displays confirmation to redact the selected match(es).

e. Once confirmed, the action(s) queue for execution:

• When successful, actions move from Queued (received) to Processing (attempted) to Most Recent: <Action>.

  • Failed actions are reported in the Action History of Location Details for any given mach.

  • It will also be noted in the EPS logs.

Note: Redaction requires the agent to be online to successfully complete; ignore actions are resolved immediately. See the description for details.

Ignore List:

To access the Ignore List:

1. From the Scan Results page, select View Ignored Locations (or Matches) from the Actions button.

2. Globally ignored matches have an N/A in the Agent column.

3. Matches can be unignored as needed.