Arctera Insight Information Governance Administrator's Guide
- Section I. Getting started
- Introduction to Arctera Insight Information Governance administration
- Configuring Information Governance global settings
- About scanning and event monitoring
- About filtering certain accounts, IP addresses, and paths
- About archiving data
- About Information Governance integration with Data Loss Prevention (DLP)
- Configuring advanced analytics
- About open shares
- About user risk score
- About bulk assignment of custodians
- Configuring Metadata Framework
- Section II. Configuring Information Governance
- Configuring Information Governance product users
- Configuring Information Governance product servers
- About node templates
- About automated alerts for patches and upgrades
- Configuring saved credentials
- Configuring directory service domains
- Adding a directory service domain to Information Governance
- Configuring containers
- Server Pools
- Section III. Configuring native file systems in Information Governance
- Configuring clustered NetApp file server monitoring
- About configuring secure communication between Information Governance and cluster-mode NetApp devices
- Configuring EMC Celerra or VNX monitoring
- Configuring EMC Isilon monitoring
- Configuring EMC Unity VSA file servers
- Configuring Hitachi NAS file server monitoring
- Configuring Windows File Server monitoring
- Configuring Arctera File System (VxFS) file server monitoring
- Configuring monitoring of a generic device
- Managing file servers
- Adding filers
- Adding shares
- Renaming storage devices
- Configuring clustered NetApp file server monitoring
- Section IV. Configuring SharePoint data sources
- Configuring monitoring of SharePoint web applications
- About the Information Governance web service for SharePoint
- Adding web applications
- Adding site collections
- Configuring monitoring of SharePoint Online accounts
- About SharePoint Online account monitoring
- Adding site collections to SharePoint Online accounts
- Configuring monitoring of SharePoint web applications
- Section V. Configuring cloud data sources
- Configuring monitoring of Box accounts
- Configuring OneDrive account monitoring
- Configuring Azure Netapp Files Device
- Managing cloud sources
- Section VI. Configuring Object Storage Sources
- Section VII. Health and monitoring
- Section VIII. Alerts and policies
- Configuring policies
- Managing policies
- Configuring policies
- Section IX. Remediation
- Configuring remediation settings
- Section X. Reference
- Appendix A. Information Governance best practices
- Appendix B. Migrating Information Governance components
- Appendix C. Backing up and restoring data
- Appendix D. Arctera Information Governance health checks
- About Information Governance health checks
- About Information Governance health checks
- Appendix E. Command File Reference
- Appendix F. Arctera Information Governance jobs
- Appendix G. Troubleshooting
- Troubleshooting FPolicy issues on NetApp devices
Managing alerts
An alert is a signal generated by a policy when the condition specified in the policy is violated.
You can view alerts on the
tab on the Management Console.To manage alerts
- In the Console, click the Policies tab.
The Alerts tab display by default. On the tab, you can view all the alerts that were generated by Information Governance.
- In the Alerts Summary, click the drop-down arrow on any column header and select Columns. Then, select the parameters you want to show or hide. You can sort by:
The name of the policy.
The severity of the alert.
The type of policy associated with the alert - Data Activity Trigger, User Activity Deviation, Real-time Permitted User-based Activity, Real-time Restricted User-based Activity, or Real-time Sensitive Data Activity.
The name of the user account that violated the policy.
The date on which the alert was generated.
The resolution, if any, taken in response to the alert.
- To send alerts in email, select the alerts and click Send Email.
- Enter the email addresses and click Send.
- To enter the resolution for an alert, select the alert, click in the Resolution column for the alert and type in the resolution.
To update the resolution for multiple alerts, select the alerts and click Update Resolution at the top of the summary table.
The events published in the DataInsightAlerts
log adhere to LEEF v 1.0 (Log Event Extended Format. LEEF is a customized event format for IBM QRadar.
See Enabling Windows event logging.
To delete alerts
- To delete an alert, select an alert and click Delete.
To delete alerts by severity, click Delete and select the severity. This deletes all alerts that match the selected severity.
To delete alerts older than a certain date, click Delete and select the date at the top of the table.
Note:
You can configure automatic deletion of alerts older than the specified interval on the Data Retention screen. However, you cannot restore the alerts once they are deleted. Alerts are also automatically published to the Windows event log.
Review the Risk Dossier to know the alerts raised in response to the policies violated by a specific user.
More Information