The classification and log analysis panel template projects are ready with the installation of the classification module. In projects where classification is activeactivities are monitored, the classification movements are recorded regularly. Classification Logs These classification logs can be written to databases or CSV files or in CEF format. Logs can be analyzed with any SIEM tool. You can also use the GEODI analysis panel for the database.
CSV or CEF Logs
...
a database and monitored and analyzed by any SIEM tool or Log Analysis Panel.
GEODI Log Analysis Panel
With the Log Analysis panel, you can monitor your classification activities and perform analysis on a user and class basis. The panel requires the logs to be in a Database.
Once you install the Classification Module, your project will be automatically activated.
You can review the following information via the panel:
Classes
Number of Classifications by Applications
Number of Classifications by Users
Classified Contents
Trend analysis number of classification by Month, Week, Year
Any user in
ACC.Classifiergroup will see the dashboard.It will process the data contained within the GEODI log records. New log entries will continue to be automatically processed according to the defined scan for changes.
Example Classification Panel
...
Log format settings and SIEM Applications
Logs may be in CSV, CEF, Syslog, or Database. GEODI Logs can be used in SIEM applications.
Database Format
For other logs, you can check the GEODI Logs page.
Object ID | Unique ID |
|---|---|
Log Time | Time of transaction |
Log User | User who doing the classification |
Log App | GEODI |
Log App Ver | GEODI Version |
Log Module | DLP Classifier |
Log Security Level | https veya http |
Log Level | medium |
File | UNCPath of classified content |
Example: C:\Users\<user>\Desktop\ |
New Word |
Doc (2).docx |
Previous Class | Current Class (value = “?” for content without a class) |
|---|---|
Class | Given Class |
Source | Method of classification (Shell/Add-In) |
Client IP | Client IP |
|---|
Client User | Client |
|---|
Process Memory(Kb)
The memory used on the system at the time the log was written.
Process Max Memory(Kb)
The peak of Memory usage in the system.
AutoClass
AutoClass kolonuna otomatik öneri olarak veya zorla kullanılmışsa otomatik ile belirlenen sınıfın ID değeri geliyor. Otomatik hiç kullanılmamışsa boş loglanacak.
ActionType
Auto: Otomatik seçilerek sınıf verildi
Manuel: Manuel sınıf seçildi.
Offline: manuel sınıf seçildi.
Username | |
AutoClass | If the AutoClass column is used as an automatic recommendation or forcibly, the ID value of the class determined automatically is provided. If automatic classification has never been used, it will be logged as empty. |
|---|---|
Action Type |
|
|
|
|
Writing Classification Logs to Database
You can also write the logs to the database if you want. In this way, it is possible to analyze with PowerBI or similar tools. You can only make connection settings from the GEODI server.
...
When the Classification Logs are written to the Database, you can access the following information in addition to the above.
...
Object ID
...
Unique ID
...
Log Time
...
time of transaction
...
Log User
...
user who doing the classification
...
Log App
...
GEODI
...
Log App Ver
...
GEODI Version
...
Log Module
...
DLPClassifier
...
Log Security Level
...
https veya http
...
Log Level
...
medium
GEODI Log Analysis Dashboard
GEODI can analyze a database via dashboards. There is a ready module to do this for Classifier Logs. Install the "Classification Log Analysis" module and create a new project using the template. The ready dashboard will give you insight into class distributions, trends, and more.
In order to use the Log Analysis Panel, "ACC.DLP":true must be added to the GenericSettings in Workspace settings, and after the "ACC.DLP" group is created, it can be used by the users in this group and the system admin.
Example Classification Panel
...
|