Views

Data Loss

Data Loss (found under Views in the left navigation) provides AI-generated, continuously refreshed analyses of your DLP incident data. Each view acts as a saved lens that scopes a specific slice of incident activity, surfacing recurring patterns, risky users, policy hotspots, and unusual behavior as a ranked list of Insights.

Rather than running manual queries, you simply open a view to see the latest AI-generated report.

The Views List

Navigate to Views > Data Loss to see your available analysis cards. Each card includes:

• Title & AI Summary: A headline summary of the latest findings.
• Insight Count Tiles: Stat tiles grouped by category, such as User Behavior, Application, Domain, Policy, Data Volume, File, and General.

Click any card to open the detailed view.

The View Detail Page

Summary Banner

A single-paragraph summary at the top of the page provides a high-level narrative of what the AI detected in the current reporting period.

Insights List

Insights are AI-generated findings that automatically surface meaningful changes, trends, and anomalies in your DLP data. Instead of manually sifting through thousands of incidents, insights answer the question: “What’s different, unusual, or worth investigating in my DLP activity right now?”    

Insights are ranked by severity (Critical → High → Medium → Low). Each card displays:

• Severity & Type: Identifying the risk level and category.
• Summary: A short description of the finding.
• Metrics & Trends: A right-hand panel showing headline metrics (e.g., “% change” compared to the prior period) or a trend sparkline.
• Status: If an insight has already been escalated, a Promoted badge appears with a direct link to the associated Case.

Incident Volume Chart & Table

Below the insights, the page provides the supporting data for the entire view:

• Volume Chart: A time-series graph showing incident counts and data transfer volume.
• Incidents Table: A paginated list of raw incidents. Clicking a row opens the full incident detail in a side panel. This is a representative sampling of the incidents that were investigated.

Understanding Insight Types

Every AI-generated finding is categorized to help you identify the root cause of the risk:

Investigating & Promoting Insights

To dive deeper, click an insight to open the Insight Side Panel. This panel provides:

• Key Findings: Factual sentences summarizing the detection.
• Why This Matters: A bulleted list explaining the specific security risk.
• Period Comparison: Side-by-side cards comparing metrics and top entities against the previous time window.
• Involved Entities: Metric rows for the specific users or apps linked to the finding.

Promote to Case

If a finding warrants a formal investigation, click Promote to Case in the side panel. AISecOps will create a new case pre-populated with all the insight’s context and evidence. Once promoted, the button will change to View Case.

Report Freshness & Access

• Automation: Insights are generated once daily at 2:30 AM PST. If you see a “Generating insights…” message, the page will update automatically once the AI completes the run.
• There are two RBAC permissions under AI Security Operations, DLP Agent and Insider Threat. DLP Agent permissions gives you permissions to all of aisecops except for Insider Threat. There are no separate permissions only for the Data Loss views.

Insider Threats

The Insider Threats page allows you to create user watchlists for specific users or groups in order to monitor for malicious activity or active malware infections. You can filter by Users, Risk Level or Watch Reasons.

Clicking the tiles in the Summary will also filter for who fall under any of those tiles. Clicking multiple tiles serves as an OR filter. These tiles are dynamically generated based on findings.

Clicking on any specific user will provide the generative analysis for that user. This analysis is dynamically generated and may include more or less than following examples.For example, some tiles such as the following will appear:

• Anomaly Breakdown

  

• DLP Incidents

  

• Behaviorial Anomalies

  

• Policy Alerts

  

• Active Malware Detections

  

• Malicious Site Visits

  

• Key Findings

  

• Recommended Actions