Search <book_title>...

Veritas Data Insight Administrator's Guide

Last Published: 2020-07-14

Product(s): Data Insight (6.1.5)

Create Real-time Data Activity User Blacklist-based policy options

Use this dialog to create a new Real-time Data Activity User Blacklist-based policy. Options selected in the respective tabs are displayed in the Summary panel on the right of the page.

Table: Create Real-time Data Activity User Blacklist-based policy options

Option	Description
Policy Information	Enter the following information: Name - The name of the policy. Description - A short description of the policy. Type - Real-time Data Activity User Blacklist-based is selected by default. Severity - The severity of the policy. The severity level associated with the policy helps you decide the possible course of action when an event that matches the policy occurs. Select the Enable Policy check box to enforce the policy. The policy is not evaluated if the check box is not selected.
Configure Policy	Select Activity - Select the type of accesses to be monitored on the selected data set. Select the Meta Access radio button to monitor only the high-level access events that Data Insight maps from the detailed file system and SharePoint access events. Select the Detailed Access radio button to monitor specific file system and SharePoint access events.
Data Selection	Do the following to select the resources: Select the Physical Hierarchy radio button to view the configured file servers or SharePoint Web applications. Or select the DFS Hierarchy radio button to view the configured DFS paths in a domain. 2 Click a path to select it. Or you can use a `.csv` file with information about the paths that you want to apply the policy to. Click Browse to navigate to the location of the `.csv` file, and click Upload. To limit the scope of the files to be monitored, select Select all files in folder or Select only sensitive files If you select the Select all files in folder option, accesses on all files in the folder are evaluated for determining any violation of the policy. If you select the Select only sensitive files option, accesses on only the sensitive files in the folder are evaluated for determining any violation of the policy. Note: The list of sensitive files is obtained from Symantec Data Loss Prevention or is imported into Data Insight using a CSV file. The files classified using Veritas Information Classifier policies are also considered as sensitive for the purpose of raising alerts. Alternatively, select All Physical Resources to select all data resources, except DFS paths configured in Data Insight. All Physical Resources evaluates all the sensitive files, not all the files. The selected data set is listed in the Selected resources pane. Note: Data Insight obtains information about sensitive files from Symantec Data Loss Prevention (DLP) or is imported into Data Insight using a CSV file. See Configuring Symantec Data Loss Prevention settings.
User attribute query	Do the following: Click Add Condition. From each of the drop-down menu, select the criteria to build the query. The query is used to select users based on their Active Directory custom attributes. You can add multiple conditions to a Real-time Data Activity User Blacklist-based policy. In case of multiple conditions with same attributes, the conditions are evaluated with a logical OR operation. In case of multiple conditions with different attributes, the conditions are evaluated with a logical AND operation.
Notifications	Enter one or more specific email addresses for people to whom you want to send alerts that are generated for the policy. Select the Notify custodians check box to send email alerts to the custodians of the selected paths along with other email addresses on the notification list.

See Configuring Symantec Data Loss Prevention settings.