Notifying Local Owners If Their Doc Was Matched in an Audit

In this Tech Tip, we have two examples of how to frame a search for an ongoing Audit or Policy.

In the first example, we look for all documents shared to or from Users in the ‘gmail.com’ domain

We are going to run a daily scan to alert local owners that their documents may breach company policy by being shared to or from the gmail.com domain.

In the Drive Audit, select ‘Users’, select from a date, pick today’s date for daily audits, pick a week back for weekly audits, etc.

Next, select ‘Documents Changed’ and then click ‘Search Documents’, this will build your search ‘chip’ and see if you have any documents that match the criteria, for the time period chosen. Remember you may have no hits, but the search rule is still valid and will catch future hits.

Finally, schedule that chip to run every night (See the next page).

In the second example, we look for all documents shared outside the domain.

We are going to run a daily scan to alert local owners that their documents may breach company policy by being shared out of the domain.

In the date range pick today’s date for daily audits, pick a week back for weekly audits, etc.

Next, select ‘Documents Changed’ and then click ‘Search Documents’, this will build your initial search ‘chip’. You further refine your search by selecting documents shared ‘Out’. Remember you may have no hits, but the search rule is still valid and will catch future hits.

Finally, schedule the full chip to run every night.

When you click Schedule/Save you will be taken to the scheduler, here you can select how you wish to see the report, as a CSV or a PDF, whether you want it to run as a policy or an audit (as an audit you get notified every time it runs, even if nothing is found, as a policy, you only get a message if a matching file is found) and the period over which it should run.  If you selected a week’s worth of data, run the report weekly, if it was a day’s worth, run the report daily.

Finally, you will see a checkbox, ‘Notify Local Users’, if you check this, local owners of the file will be warned that their files were found by the search, that they may be in breach of company policy and they will be given a list of the files.

Comments

comments