About Endpoint Events
With Endpoint Data Loss Protection (DLP), Netskope monitors your users and USB storage devices for policy violations. You can view all user and device activities that haven’t violated a policy in Skope IT > Endpoint Events.
When events violate your Device or Content Control policies, Netskope generates an alert for the event, which you can view in Skope IT Alerts (Skope IT > Alerts). Events that violate your Content Control policies also trigger a DLP incident (Incidents > DLP).
Starting from R119, printer policies will be enforced when a user tries to print to a blocked printer. A popup notification will only occur when a user prints to a blocked printer, instead of when the printer is configured. This means the administrator will only see events/alerts for printers when a user tries to print to a blocked printer.
Viewing Device Events
To view events triggered by Device Control policies in your organization, go to Skope IT > Endpoint Events > Device.
You can select from a wide range of filter options. Your most recent filter selection will be displayed when you revisit the page.
On the Device Events page, you can:
- Refresh the device results.
- Filter device events by a specific time frame. You can use a predefined time frame or choose Date Range to use the calendar and time menus to customize your own.
- Search and filter the device events by user. Click + Add Filter to add other filters to narrow your search results. You also can click
to save the filter combination for future searches. - View a list of device events. For each event, you can see the following information:
- Time (Default)
- Activity (Default)
- USB Device Name (Default)
- User (Default)
- Computer Name (Default)
- Event Type
- Offline Event
- USB Device ID
- USB Device SN
- USB Device Type
- Model
- Manufacturer
- OS User Name
- OS
- OS Details
- Policy Name
- Policy Name Enforced
- Policy Version
- Policy Action
- Policy Action Enforced
- Click
to view more information on the device event. Following are some helpful fields for investigating the event:- Manufacturer: The manufacturer of the USB device, as stored on the device. This may be a text name or the USB-IF-issued vendor ID.
- Device ID: The instance ID for the device.
- Device SN: The serial number of the device.
- Device Type: The device class.
- Model: The model of the USB device. This may be a text name or a numeric product ID.
- Device: The name of the device.
- Sort the table by the time the device events occurred.
- Export all device events (up to 500,000 rows) to a CSV file.
- Click
to customize table columns or restore the default ones. - View up to 100 device events per page.
- View multiple pages of the table.
Viewing Content Events
To view events triggered by Content Control policies in your organization, go to Skope IT > Endpoint Events > Content.
On the Content Events page, you can:
- Refresh the content results.
- Filter content events by a specific time frame. You can use a predefined time frame or choose Date Range to use the calendar and time menus to customize your own.
- Search and filter the content events by user. Click + Add Filter to add other filters to narrow your search results. You also can click to save the filter combination for future searches.
- View a list of content events. For each event, you can see the following information:
- Time (Default)File Name (Default)Activity (Default)USB Device Name (Default)User (Default)Computer Name (Default)File DirectoryFile PathExecutable HashExecutable SignedFile MD5File SHA256File OriginFile SizeFile TypeEvent Type
Offline EventUSB Device IDUSB Device SNUSB Device TypeModelManufacturerOS User NameDLP Profile Name
OSOS DetailsPIDProcess Cert SubjectProcess NameProcess PathPolicy NamePolicy Name EnforcedPolicy VersionPolicy ActionPolicy Action Enforced
- Time (Default)File Name (Default)Activity (Default)USB Device Name (Default)User (Default)Computer Name (Default)File DirectoryFile PathExecutable HashExecutable SignedFile MD5File SHA256File OriginFile SizeFile TypeEvent Type
- Click to view more information on the content event. Following are some helpful fields for investigating the event:
- File Type: The type of file.
- Size (Bytes): The file size in bytes.
- File Directory: The directory where the file is stored.
- File Name: The name of the file.
- File Path: The full file path.
- Process ID: The process ID for the process that performs the file operation.
- Process Name: The name of the process that performs the file operation.
- Process Path: The full path of the executable for the process that performs the file operation.
- MD5: The MD5 hash of the file. You can use this hash value to filter Skope IT events and view other activity associated with the file.
- SHA256: The SHA-256 hash of the file. You can use this hash value to filter Skope IT events and view other activity associated with the file.
- Sort the table by the time the content events occurred.
- Export all content events (up to 500,000 rows) to a CSV file.
- Click to customize table columns or restore the default ones.
- View up to 100 content events per page.
- View multiple pages of the table.
