Veritas Data Insight Administrator's Guide
- Section I. Getting started
- Introduction to Veritas Data Insight administration
- Configuring Data Insight global settings
- Overview of Data Insight licensing
- About scanning and event monitoring
- About filtering certain accounts, IP addresses, and paths
- About archiving data
- About Data Insight integration with Symantec Data Loss Prevention (DLP)
- Configuring advanced analytics
- About open shares
- About bulk assignment of custodians
- Section II. Configuring Data Insight
- Configuring Data Insight product users
- Configuring Data Insight product servers
- About node templates
- About automated alerts for patches and upgrades
- Configuring saved credentials
- Configuring directory service domains
- Configuring containers
- Section III. Configuring native file systems in Data Insight
- Configuring NetApp file server monitoring
- Configuring clustered NetApp file server monitoring
- About configuring secure communication between Data Insight and cluster-mode NetApp devices
- Configuring EMC Celerra or VNX monitoring
- Configuring EMC Isilon monitoring
- Configuring EMC Unity VSA file servers
- Configuring Hitachi NAS file server monitoring
- Configuring Windows File Server monitoring
- Configuring Veritas File System (VxFS) file server monitoring
- Configuring monitoring of a generic device
- Managing file servers
- Adding filers
- Adding shares
- Renaming storage devices
- Configuring NetApp file server monitoring
- Section IV. Configuring SharePoint data sources
- Configuring monitoring of SharePoint web applications
- About the Data Insight web service for SharePoint
- Adding web applications
- Adding site collections
- Configuring monitoring of SharePoint Online accounts
- About SharePoint Online account monitoring
- Adding SharePoint Online accounts
- Adding site collections to SharePoint Online accounts
- Configuring monitoring of SharePoint web applications
- Section V. Configuring cloud data sources
- Section VI. Configuring ECM data sources
- Section VII. Health and monitoring
- Section VIII. Alerts and policies
- Section IX. Remediation
- Section X. Reference
- Appendix A. Backing up and restoring data
- Appendix B. Data Insight health checks
- Appendix C. Command File Reference
- Appendix D. Data Insight jobs
- Appendix E. Troubleshooting
- Troubleshooting FPolicy issues on NetApp devices
Managing alerts
An alert is a signal generated by a policy when the condition specified in the policy is violated.
You can view alerts on the
tab on the Management Console.To manage alerts
- In the Console, click the Policies tab.
The Alerts tab display by default. On the tab, you can view all the alerts that were generated by Data Insight.
- In the Alerts Summary, click the drop-down arrow on any column header and select Columns. Then, select the parameters you want to show or hide. You can sort by:
The name of the policy.
The severity of the alert.
The type of policy associated with the alert - Data Activity Trigger, User Activity Deviation, Real-time Data Activity User Whitelist-based, Real-time Data Activity User Blacklist-based, or Real-time Sensitive Data Activity.
The name of the user account that violated the policy.
The date on which the alert was generated.
The resolution, if any, taken in response to the alert.
- To send alerts in email, select the alerts and click Send Email.
- Enter the email addresses and click Send.
- To enter the resolution for an alert, select the alert, click in the Resolution column for the alert and type in the resolution.
To update the resolution for multiple alerts, select the alerts and click Update Resolution at the top of the summary table.
The events published in the DataInsightAlerts
log adhere to LEEF v 1.0 (Log Event Extended Format. LEEF is a customized event format for IBM QRadar.
See Enabling Windows event logging.
To delete alerts
- To delete an alert, select an alert and click Delete.
To delete alerts by severity, click Delete and select the severity. This deletes all alerts that match the selected severity.
To delete alerts older than a certain date, click Delete and select the date at the top of the table.
Note:
You can configure automatic deletion of alerts older than the specified interval on the Data Retention screen. However, you cannot restore the alerts once they are deleted. Alerts are also automatically published to the Windows event log.
Review the Risk Dossier to know the alerts raised in response to the policies violated by a specific user.