Filters, Events, and Export
- Clicking a dataset, policy, location, or username applies a filter to show matching flows; multiple filters can be combined.
- Active filters appear near the top left. Remove them individually with the X, or click Clear All.
- Displays sources and destinations appearing in dataflows that matched at least one dataset.
- Location types include email, cloud storage, cloud apps, websites, network shares, endpoints, specific applications, removable media, and printers.
- Select a location to view related events, or use the kebab menu to add it to a dataset, policy, or list.
- Lists users involved in matching dataflows.
- Click a user to review their events; the kebab menu lets you add the user to a list.
- Shows event-level details: risk, dataset, triggered policy, users, content, and timestamp.
- The Content column indicates how many attributes matched the dataset; click to view attributes.
- Expand an event to see the sequence of actions that triggered the policy.
- Export the Events table to a
.csv file (limited to 20,000 rows).
- Reduce exported rows by filtering on locations/users or shortening the date range with the date picker.