Arctera Insight Information Governance Administrator's Guide

Data Activity Trigger policy

Use this policy to define the maximum cumulative count of the meta operations on the selected paths. For example, if you have defined the maximum accesses per day as 500 on the share \\netapp1\finshare, and the total access count by the active set of users exceeds 500, then Information Governance generates an alert.

User Activity Deviation Policy

Use this policy to define the threshold of deviation from the baseline activity. The baseline activity on a file or folder is the average number of accesses that are considered normal based on past access counts. If the activity, by the selected users, on the selected data exceeds the specified threshold of the baseline (for example, three standard deviations above the baseline activity), and the maximum accesses allowed per day, Information Governance generates an alert.

You can configure how many standard deviations a user is allowed to deviate from the defined baseline.

Real-time Data Activity Policy

Use this policy to identify specific file types using the file groups configured in Information Governance. This policy will create a mechanism to generate alerts about ransomware attacks or restricted content types in selected shares or paths. It will also generate notifications when selected activities are performed on the available content.

Real-time Permitted User-based Activity Policy

Use this policy to define a permitted users based on the Active Directory custom attributes, who can access selected shares or paths. Also, you can create such a policy with multiple conditions with multiple values for the same custom attributes.

Whenever the events that violate Real-time Permitted User-based Activity Policy are processed by an Indexer node, Information Governance generates alerts and an email is sent to a configured list of recipients in real-time.

Real-time Restricted User-based Activity Policy

Use this policy to define restricted users based on the Active Directory custom attributes, who should not be accessing selected shares or paths. Also, you can create such a policy with multiple conditions with multiple values for the same custom attributes.

Whenever the events that violate Real-time Restricted User-based Activity Policy are processed by an Indexer node, Information Governance generates alerts and an email is sent to a configured list of recipients in real-time.

Real-time Sensitive Data Activity Policy

Use this policy to trigger real-time alerts when a selected set of users perform any access events on the paths that violate configured DLP policies. Whenever the events that violate Real-time Sensitive Data Activity Policy are processed by a Indexer node, alerts are generated and an email is sent to a configured list of recipients.