Working with Scan Results

The Scan Results screen shows the results of all of your scans. It's important to remember:

  • There are three types of scans:

    • Discovery Scans

    • Sensitive Data Scans

    • Data Watcher Scans

  • You can search for scans based on different criteria and filter views

Scan Results help you to understand:

  • What Data is being scanned

  • Type of scan

  • Date of the scan

  • What Playbook(s) are being used

  • What Data Type used

  • Who owns the targets being scanned

  • Location(s) of data

  • Results and resolution of the scans

Expand a section for more information:

To view Scan Results:

1. From the left menu, click Scans.

2. Click Scan Results.

3. The Find Scan Results page displays. From the selection criteria on the right, select options from the drop-down list to sort scan results and click Find Scan Results. Else, just click Find Scan Results.

4. Scans Results are displayed in a list sorted by column.

  • Scan Type

  • Scan Name

  • Priority (Weighting)

  • Date/Time (Discovered)

  • Date/Time (Most Recent)

  • Playbook(s)

  • Playbook Status

  • Data Type

  • Classification(s)

  • Location

  • Match

  • Resolution

  • Total Location Match Count

  • Agent Scanning

  • Target Being Scanned

  • File Owner

  • Assignee

5. You can further sort the results:

a. Click Actions.

b. Select any of the following options:

  • View Scan Results by Match

  • View Results Upload Status

6. You can Customize the Columns:

a. Click Actions.

b. Select Customize Columns.

c. Select the columns you want to display and click Customize. See Customizing Scan Results Columns for more information.

7. Use Filters to locate scans using specific criteria. See Using Filters to Find Scan Resultsults for more information.

To search for a Scan Result:

1. Type a location name in the search box and click the lens icon or Enter on your keyboard.

2. The results are displayed in a list below.

3. Click the x to clear the search term.

To use the filter feature to find Scan Results based on specific criteria:

1. On the Find Scan Results screen, select a criteria with which you want to sort the scan results.

d. Scan Type

From the drop-down list, select a Scan Type. For example: Discovery.

  • All Scans
  • Discovery
  • Sensitive Data
  • Data Watcher

e. Other Selection criteria

1) For the below selection criteria, select one or more items from the drop-down list.

  • Scan Name
  • Target
  • Tag
  • Data Type
  • Playbook Status
  • Playbook Name
  • Assignee

2) Click Apply to apply the filter.

3) Click Clear and then click Apply to remove the filter.

Note: You can add multiple filters. However, adding multiple filters can extend the wait time for the search results.

2. Click Clear All to clear all the filters, else click Find Scan Results. The Scan Results screen appears.

3. In the upper left of the screen, go to the Filters .

4. For the below selection criteria, select one or more items from the drop-down list. For example: Target

  • Scan Name
  • Target
  • Tag
  • Data Type
  • Playbook Status
  • Playbook Name
  • Assignee

1) Click Apply to apply the filter to the Scan Results list.

2) Click Clear and then click Apply to remove the filter.

3) The results are displayed in the Scan Results table.

5. To remove all the set filters click Clear All.

Note: You can add multiple filters. However, adding multiple filters can extend the wait time for the search results.

To customize scan results column:

1. In the top right of the screen, click Actions.

2. Click Customize Columns from the drop-down list.

3. In the Customize Columns pop-up window, select the columns to display in the Scan Results. For example, if you select all the columns except Date/Time (Most Recent), it does not display in the Scan Results.

4. Click Customize. The Scan Results page displays with the selected columns.

To ignore results:

1. From the Scan Results screen, locate the result you want to ignore.

2. Click the kebab menu on the right and select View Matches.

3. In the Location Details pop-up window, locate the record you want to ignore and in the User Action column, select Ignore.

4. In the Match Actions section, click Ignore.

5. In the Ignore Matches pop-up window, select one:

  • Discovering Agent

  • All Agents

6. Click Confirm to save or Cancel to discard.

7. Click Close.

You can view ignored results from your Scan by:

  • Location

  • Matches

To view or change the status of ignored Locations:

1. Go to Scans then Scan Results.

2. Select one or more scans you want to reivew for ignored results.

3. Click Actions.

4. Select View Ignored Locations.

5. In the Ignored Locations pop-up window, you can view all ignored Locations.

6. To unignore a Location:

a. In the Ignored Locations pop-up window, find the Location you want to unignore.

b. From the kebab menu on the right, select Unignore.

c. The Location status will be updated when you next run the scan.

1. Go to Scans then Scan Results.

2. Select one or more scans you want to reivew for ignored results.

3. Click Actions.

4. Select View Ignored Matches.

5. In the Ignored Matches pop-up window, you can view all ignore Matches.

6. To unignore a Match:

a. In the Ignored Matches pop-up window, find the Match you want to unignore.

b. From the kebab menu on the right, select Unignore.

c. The Match status will be updated when you next run the scan.

To view the detailed status of all your Scans and the total Uploads Count:

1. In the top right of the screen, click Actions.

2. Click View Results Upload Status from the drop-down list.

3. The results are displayed in a list sorted by column:

  • ID

  • Type

  • Flag

  • Error

  • State

  • Size

  • Search Detail Id

  • Begin Import Timestamp

  • Agent Name

  • Error Details

  • Target Guid

4. The Upload Counts sections shows count of the following:

  • Uploads Working

  • Uploads Failed

  • Uploads Done

5. Click Back To Scan Results to go back to the Scan Results page.

To view detailed information of a scan result:

1. Click the playbook(s) link of a scan result.

2. Expand to view each file information section on the Playbook Executor page. Each section displays the playbook executor of the scan result until you click the down arrow () and then appears at the bottom of the section.

The header displays the following information.

1) Previous: Navigates to the previous result location. The button is disabled if you are on the first location.

2) Next: Navigates to the next result location. The button is disabled if you are on the last location.

3) Back to List: Navigates to the Scan Results page.

4) File: The path of the file where the scan results are found.

5) Location: The path of the location where the scan results are found.

6) Scan Name: The name of the scan performed on the scanned file.

7) Last Search Date/Time: The date and time when the scan was last performed.

8) Target Name: The target of the scanned file.

9) Date Created: The create date of the scanned file.

10) Date Modified: The last modified date of the scanned file.

11) Date Accessed: The access date of the scanned file.

12) Classification: The classification applied to the scanned file.

In the Matches section, click the down arrow ().

The following information displays:

1) Data Type: The data type that is found in the scan result.

2) Action: The action that is performed on the data type. For example: Classification

3) Total Occurrences: Total occurrences of a data type found in the file scanned.

4) File Preview: Data type match from the file scanned.

The matches section displays the following:

1) Access Date: The access date of the scanned file.

2) Create Date: The create date of the scanned file.

3) Data Type: The data type searched in the scanned file.

4) File Attribute: The attribute of the scanned file.

5) File Owner: The owner of the scanned file.

6) File Name: The name of the file being scanned.

7) File Size:The size of the scanned file.

8) File Location: The location of the scanned file.

9) Modify Date: The last modified date of the scanned file.

10) Scan Name: The name of the scan performed on the scanned file.

11) Last Search Time/Date: The date and time when the last scan was performed.

12) Search User: The user who performed a search on the file.

13) Target Name: The endpoint where the file was scanned.