In projects where classification is active, the classification movements are recorded. Classification Logs can be written to databases or CSV files or in CEF format. Logs can be analyzed with any SIEM tool. You can also use the GEODI analysis panel for the database.
...
GEODI logs all classification activity. The log format may be a database, CSV, CEF, or syslog. You may use a SIEM or Log Analysis Panel to analyze the logs.
GEODI Log Analysis Dashboard
Log Analysis shows and analyses classification activities using the log records.
The dashboard comes ready in a template project. Please follow the steps for dashboard activation.
You already have a GEODI project for policies. The dashboard will be another project.
Create a new project → Choose Classification Log Analysis Template
You will see a DB data source; change DB settings to log DB.
Log format on Classification must be set to Database.
Any user in ACC.DLP group will see the dashboard.
Save and Start indexing
GEODI will process the logs and the new ones.
Example Classification Panel
...
Log format settings and SIEM Applications
Logs may be in CSV, CEF, DB, or sent with syslog and compatible with SIEMs. Log settings are done on the classification policy manager.
...
CSV or CEF format
\AppData\Dece\Geodi\Workspaces<ProjectName>\Logs\DLPClassifier.Optionally, it can also be saved in the Database.For other logs, you can check the GEODI Logs page.
File | UNCPath of classified content Örnek: C:\Users\<user>\Desktop\Yeni Microsoft Word Belgesi (2).docx |
|---|---|
PreviousClass | Current Class (value = “?” for content without a class) |
Class | Given Class |
Source | Method of classification (Shell/Add-In) |
ClientIP | Client IP |
ClientUser | Client User Name |
Process Memory(Kb) | The memory used on the system at the time the log was written. |
Process Max Memory(Kb) | The peak of Memory usage in the system. |
AutoClass | If the AutoClass column is used as an automatic recommendation or forcibly, the ID value of the class determined automatically is provided. If automatic classification has never been used, it will be logged as empty. |
ActionType |
|
...
Database format
You can also write the logs to the database if you want. In this way, it is possible to analyze with PowerBI or similar tools. You can only make connection settings from the GEODI server.
...
When the Classification Logs are written to the Database, you can access the following information in addition to the aboveWhen the log format is DB, the following fields are also logged.
Object ID | Unique ID |
|---|---|
Log Time | time of transaction |
Log User | user who doing the classification |
Log App | GEODI |
Log App Ver | GEODI Version |
Log Module | DLPClassifier |
Log Security Level | https veya http |
Log Level | medium |
GEODI Log Analysis Dashboard
GEODI can analyze a database via dashboards. There is a ready module to do this for Classifier Logs. Install the "Classification Log Analysis" module and create a new project using the template. The ready dashboard will give you insight into class distributions, trends, and more.
In order to use the Log Analysis Panel, "ACC.DLP":true must be added to the GenericSettings in Workspace settings, and after the "ACC.DLP" group is created, it can be used by the users in this group and the system admin.
Example Classification Panel
...