Skip to content

How to manage user resolved data items

How to manage user resolved data itemslink

Part of the process of managing your data will be to check and confirm that the resolutions reported by end users are correct and conform with you data management policy. This process of oversight can be managed from the Endpoint Manager.

In order to create a Search schedule you must have a user account and be logged in to the Ascema Endpoint manager; see How to manage Ascema user accounts.

The starting point for managing user resolved items, see How to use the Ascema Search Reports to review sensitive data management.

Confirming correct ownership of datalink

When users believe that they are correctly holding data within your organisation's data policy they will resolve the data alert by selecting I am allowed to have this content. The Ascema system allows you to review this resolution and then confirm that this has been applied correctly.

  • Within the Ascema Search Reports use the Filter by status to view all the User Resolved items
  • A list of devices will be displayed on which there are one or more user resolved items
  • The device report will be displayed for the device on which this data was found and resolved by the user
  • Use the Filter By Status to view only those items which are User Resolved
  • Opening up the file details you will see the alert as the user saw it when marking the item resolved
  • Viewing this as a signed in user you will have additional options to complete the resolution of the issue
  • To confirm that the issue has been resolved correctly select the Confirm this issue is resolved button

Info

If there is a problem with the resolution or your organisation's data policy has not been followed correctly you might instead select Alert this issue is not resolved. If you select this then a new alert will be generated to the user and the item will again appear in reports as alerted and requiring resolution.

Confirming an item is a false matchlink

As part of its operation the Ascema system will sometimes find items which match on a pattern for sensitive data but which when viewed in context are not items that are sensitive and require management. The Ascema system enables users to mark such items as This is a false match. The Ascema Endpoint manager enables you to confirm these items as false matches.

Where an item is likely to show up as a false match in many places the Ascema system provides a facility to manage this across different devices and/or files in which it may reside - see How to use the ignore function to improve Ascema search accuracy

  • Within the Ascema Search Reports use the Filter by status to view all the User Resolved items
  • A list of devices will be displayed on which there are one or more user resolved items
  • The device report will be displayed for the device on which this data was found and resolved by the user
  • Use the Filter By Status to view only those items which are User Resolved
  • Opening up the file details you will see the report as the user saw it when marking the item as a false match
  • Viewing this as a signed in user you will have additional options to complete the resolution of the item
  • To confirm that the issue has been resolved correctly select the Confirm this issue is resolved button

Info

If on review this is not a false match but is sensitive data you might instead select Alert this issue is not resolved. If you select this then a new alert will be generated to the user and the item will again appear in reports as alerted and requiring resolution.

On review you might instead decide that this is a false match that could affect other files or other users, to manage such items see How to use the ignore function to improve Ascema search accuracy