Skip to content

Review Sensitive Data Management

Image Not Found Image Not Found Image Not Found

How to use the Data Discovery Search Reports to review sensitive data managementlink

The Data Discovery system provides overview reports which allow users with accounts to view the sensitive data discovered by Data Discovery Manager searches and to take a number of actions as part of the process of resolving and managing the presence of sensitive data.

In order to use the Search Reports you must have a User, Auditor or Administrator account and be logged into DDM ; see How to manage Data Discovery user accounts.

Reviewing sensitive data reportslink

By use of the Data Discovery Search Reports you can gain an overview of sensitive data which has been found across your organisation. These reports give you a number of ways to view information about this data to help you understand and report on the any issues.

  • From the menu bar expand the Search option
  • From the task options select View Results
  • You will now see Data Discovery Search Results page
  • The Search Results page provide you with a number of different ways to view information about the sensitive data which has been found

Filtering Search results by Search Task Instancelink

When the search results are displayed you will see the default grouping and filtering of the data. To change those defaults

The Search results can be filtered to show only the results from specified search instances. To expand select Data selection

  • check/select the task instances to filter the results and the Apply Selection button

Image Not Found

  • By default all the Search Task Instances are selected
  • Instance can be selected or unselected individually be clicking on each instance row
  • Alternatively you can unselect all instances using the Unselect all instances button which will leave the menu clear for you to select only the instances you want

Image Not Found

When you select just a single instance then only the data items found by that search instance will be shown on the Search Report

  • In this example having selected an NHS number search only those items found in that search are shown on the report
  • The information on this Search Report can be grouped and the rows expanded to see further details in the same way as the unfiltered report
  • If there no data items were detected in the filtered Search Instances then a blank report will be displayed

Grouping information on the reportlink

  • There are five ways to group the information

    • By Device on which the data was found
    • By Pattern for which the search was looking when it found the data
    • By File Path of the file in which the data was found
    • By User account under which the Data Discovery agent was running
    • By Areas and Applications which could for example be an area within an Office 365 instance
  • When you first open the reports the information will be grouped by Pattern
  • To change the grouping select the dropdown for Group By
  • From the list of options select the grouping you want for the report
  • Alongside each of the summary rows is an arrow icon which you can click to expand the information for that row
  • Having clicked on the arrow icon expanded information for the row will be displayed
  • As the report is still grouped by Pattern this will show all of the sensitive information items which matched that pattern
  • Each row has a further arrow which can be clicked to show the details of matches within the file
  • Each line also has a quickview icon which is the eye icon on the right hand side
  • Placing the mouse pointer over this icon will display a quick view of the matches found in that file
  • Clicking on the arrow icon next to a file will expand the report out so you are able to review the individual data items within the file
  • In this example there one item which was detected as a UK NHS Number
  • Each item of data can have a different status to show where it is in the resolution process
  • In this example the item has been alerted to the end user and no further action has yet been taken
  • Each data item also has an information icon diplayed next to it
  • When youclick the information icon you will be able to see full details of the data which has been alerted.

Filtering for values within a groupinglink

For each way in which you can group data there is a corresponding filter which you can use to limit the data displayed to just that which you want to view

  • Enter text or partial text for the value you wish to filter on
  • The report will respond by excluding all rows which do not include the filter value

Filtering Search Reports by Statuslink

Each potentially sensitive data item which has been identified by the Data Discovery system has a status associated with it, representing where that item is in the resolution process. While managing the overall process of resolution across an organisation it can be very useful to filter the items displayed to show only those which currently need to be acted on.

  • The Status controls give you one button for each status which data items might be in
  • In their default positions all the slider buttons (except Ignored) are enabled and all data items will be displayed
  • Clicking on a button will disable that status and data items in that status will no longer be displayed
  • If for example the buttons are all switched to off except for the Quarantined button then only data items which have been Quarantined will be displayed
  • In this example two files are currently in quarantine
  • If there are no data items currently in the filtered status then a blank report will be displayed

Info

By default Ignored items will not be shown on the report although a count of ignored items is shown next to the Include Ignored checkbox. If you wish to see Ignored items then select the Include Ignroed checkbox. Ignoring items works alongside other filters so when you enable viewing of Ingored items only those which otherwise match your filters will then be displayed.

Refreshing the Search Reportlink

Sometimes the information held by the system will be updated while you are reviewing a report, either because of a search which is taking place or as a result of actions by other users. If you wish to be sure that what you are viewing is the very latest information you can use the Refresh Results button to update your report.

Exporting Search Report resultslink

While the Search Reports give you a number of ways to view your information about sensitive data sometimes you will need to put that information into another format so you can produce written reports or combine information from other sources.

  • From the Data Discovery Endpoint manager home screen select the Search Reports menu item
  • Group and filter your report as described above until you have just the information which you wish to export
  • Select the Export link on the report page
  • The export dialog will then be displayed
  • You may enter a filename for your export
  • You may enter a sheet name for the export which will be used if you export to a spreadsheet format such as Excel
  • Select the Export filetype type dropdown menu to see the available file types you can export into

Image Not Found

  • Select the file type from the list
  • Select the export button

  • The file will be created in the normal place your browser stores downloaded files.

Info

Due to the nature of the information you are downloading the spreadsheet file types will often produce the most useful results; such as Microsoft Excel, OpenDocument Spreadsheet or CSV files