Arctera Insight Information Governance

Credentials in freeform text

This policy is used to generate alerts for files that contain credentials in freeform text. After classification, Information Governance checks for the Authentication tag attached to the classified files and raises alerts for potential violations.

This is a singleton policy, meaning only one instance is created per tenant. The policy can be edited, but it cannot be deleted or disabled.

Data owner identification

This policy is used to identify the Data Owner of files based on audit information. The user with the highest number of write accesses is considered the file owner. If write access data is not available, the user with the highest number of total accesses is assigned as the owner.

The policy runs daily on a defined schedule and evaluates only those files that have recorded user access events. Server administrators can customize the policy by modifying the data scope, ownership criteria, or execution schedule to suit organizational needs.

Once the policy is executed, ownership is assigned to qualifying files. The identified data owner can be viewed in the Data Summary section on the Workspace > Data page.

This is a singleton policy, meaning only one instance is created per tenant. The policy can be edited, but it cannot be deleted or disabled.

Ransomware alerts

This policy is used to generate alerts for files whose extensions match those defined in the Ransomware file group. After scan data is ingested, Information Governance checks for files with these extensions and raises alerts by sending email notifications to the server administrator for any violations detected.

Server administrators can enable, disable, or delete this policy as needed. They also have the option to create a new policy of type Filegroup Based, copy the existing policy, or edit it to modify the data scope and specify a different file group to monitor.

Sensitive data identification

This policy is used to identify sensitive files across data sources. Server administrators can configure the policy by specifying a list of tags that are considered sensitive.

Once classification is completed, Information Governance checks the tags attached to the classified files. If any of the configured sensitive tags are found, the files are marked as sensitive.

This policy is automatically executed whenever a classification request is run.

User activity on sensitive data

This policy is used to generate alerts when users access sensitive files. After audit data ingestion, Information Governance evaluates access events to detect any user activity on files marked as sensitive. If such access is found, an email alert is sent to the server administrator indicating a sensitive data access violation.

Server administrators can enable, disable, or delete this policy. They can also create a copy of the existing policy or edit it to adjust the data scope, specify which users to monitor, and define the types of accesses to track.

External users data activity

The External User Data Activity policy is a default policy automatically created by Information Governance for each tenant. This policy is triggered when any unknown or external user - defined as a user not part of any added domain - performs any action on files. An email notification is sent to all server administrators detailing the access events.

Server administrators can enable, disable, or delete this policy. They also have the option to create a new policy of type User Data Accesses, duplicate the existing policy, or edit the policy to modify the data scope, specify users to monitor, and define the access types to track.