IronPort - daily management guide - AsyncOS 7.6.1

Chapter 2 Using Email Security Monitor
The Content Filters Page
Content Filter Details
OL-25138-01
Email Security Monitor Pages
The page also includes an Incidents by Sender listing at the bottom of the page that lists each internal
user who has sent a message that violated the DLP policy. The listing also shows the total number of
DLP incidents for this policy per user, with a breakdown by severity level, and whether any of the
messages were delivered in the clear, delivered encrypted, or dropped. You can use the Incidents by
Sender listing to find out which users may be sending your organization’s sensitive data to people outside
your network.
Figure 2-23 DLP Policy Details Charts: Top Incidents by Severity, Incident Summary
Figure 2-24 DLP Policy Incidents by Sender
Clicking on the sender name opens up the Internal Users page. See The Internal Users Page, page 2-21
for more information.
The Content Filters page shows information about the top incoming and outgoing content filter matches
(which content filter had the most matching messages) in two forms: a bar chart and a listing. Using the
Content Filters page, you can review your corporate policies on a per-content filter or per-user basis and
answer questions like:
Which content filter is being triggered the most by incoming or outgoing mail?
Who are the top users sending or receiving mail that is triggering a particular content filter?
You can click the name of the content filter in the listing to view more information about that filter on
the Content Filter detail page.
The Content Filter detail page displays matches for that filter over time, as well as matches by internal
user.
Cisco IronPort AsyncOS 7.6 for Email Daily Management Guide
2-25