Data Loss
Data Loss (found under Views in the left navigation) provides AI-generated, continuously refreshed analyses of your DLP incident data. Each view acts as a saved lens that scopes a specific slice of incident activity, surfacing recurring patterns, risky users, policy hotspots, and unusual behavior as a ranked list of Insights.
Rather than running manual queries, you simply open a view to see the latest AI-generated report.
The Views List
Navigate to Views > Data Loss to see your available analysis cards. Each card includes:
- Title & AI Summary: A headline summary of the latest findings.
- Insight Count Tiles: Stat tiles grouped by category, such as User Behavior, Application, Domain, Policy, Data Volume, File, and General.
Click any card to open the detailed view.
The View Detail Page
Summary Banner
A single-paragraph summary at the top of the page provides a high-level narrative of what the AI detected in the current reporting period.
Insights List
Insights are AI-generated findings that automatically surface meaningful changes, trends, and anomalies in your DLP data. Instead of manually sifting through thousands of incidents, insights answer the question: “What’s different, unusual, or worth investigating in my DLP activity right now?”
Insights are ranked by severity (Critical → High → Medium → Low). Each card displays:
- Severity & Type: Identifying the risk level and category.
- Summary: A short description of the finding.
- Metrics & Trends: A right-hand panel showing headline metrics (e.g., “% change” compared to the prior period) or a trend sparkline.
- Status: If an insight has already been escalated, a Promoted badge appears with a direct link to the associated Case.
Incident Volume Chart & Table
Below the insights, the page provides the supporting data for the entire view:
- Volume Chart: A time-series graph showing incident counts and data transfer volume.
- Incidents Table: A paginated list of raw incidents. Clicking a row opens the full incident detail in a side panel. This is a representative sampling of the incidents that were investigated.
Understanding Insight Types
Every AI-generated finding is categorized to help you identify the root cause of the risk:
| Label | What it Surfaces |
|---|---|
| Data Volume | Significant spikes or drops in data transfer or incident counts. |
| User Behavior | Individuals or groups whose activity deviates from the norm. |
| Application | Unusual activity within specific apps (e.g., Google Drive, Dropbox). |
| Domain | High volumes of data moving to specific external domains. |
| Policy | Specific DLP policies triggering at unusual rates. |
| File | Specific files (by MD5) being transmitted repeatedly. |
| General | Cross-entity findings that don’t fit a single category. |
Investigating & Promoting Insights
To dive deeper, click an insight to open the Insight Side Panel. This panel provides:
- Key Findings: Factual sentences summarizing the detection.
- Why This Matters: A bulleted list explaining the specific security risk.
- Period Comparison: Side-by-side cards comparing metrics and top entities against the previous time window.
- Involved Entities: Metric rows for the specific users or apps linked to the finding.
Promote to Case
If a finding warrants a formal investigation, click Promote to Case in the side panel. AISecOps will create a new case pre-populated with all the insight’s context and evidence. Once promoted, the button will change to View Case.
Report Freshness & Access
- Automation: Insights are generated once daily at 2:30 AM PST. If you see a “Generating insights…” message, the page will update automatically once the AI completes the run.
- There are two RBAC permissions under AI Security Operations, DLP Agent and Insider Threat. DLP Agent permissions gives you permissions to all of aisecops except for Insider Threat. There are no separate permissions only for the Data Loss views.
Insider Threats
The Insider Threats page allows you to create user watchlists for specific users or groups in order to monitor for malicious activity or active malware infections. You can filter by Users, Risk Level or Watch Reasons.
Clicking the tiles in the Summary will also filter for who fall under any of those tiles. Clicking multiple tiles serves as an OR filter. These tiles are dynamically generated based on findings.

Clicking on any specific user will provide the generative analysis for that user. This analysis is dynamically generated and may include more or less than following examples.For example, some tiles such as the following will appear:









