GEODI logs all classification activity. The log format may be a database, CSV, CEF, or syslog. You may use a SIEM or Log Analysis Panel to analyze the logsThe classification and log analysis panel template projects are ready with the installation of the classification module. In projects where classification activities are monitored, classification movements are recorded regularly. These classification logs can be written to a database and monitored and analyzed by any SIEM tool or Log Analysis Panel.
GEODI Log Analysis
...
Panel
With the Log Analysis shows and analyses classification activities using the log records.
The dashboard comes ready in a template project. Please follow the steps for dashboard activation.
...
You already have a GEODI project for policies. The dashboard will be another project.
...
Create a new project → Choose Classification Log Analysis Template
You will see a DB data source; change DB settings to log DB.
...
panel, you can monitor your classification activities and perform analysis on a user and class basis. The panel requires the logs to be in a Database.
Once you install the Classification Module, your project will be automatically activated.
You can review the following information via the panel:
Classes
Number of Classifications by Applications
Number of Classifications by Users
Classified Contents
Trend analysis number of classification by Month, Week, Year
Any user in
ACC.DLPClassifiergroup will see the dashboard.Save and Start indexing
...
It will process the
...
data contained within the GEODI log records. New log entries will continue to be automatically processed according to the defined scan for changes.
Example Classification Panel
...
Log format settings and SIEM Applications
Logs may be in CSV, CEF, DBSyslog, or sent with syslog and compatible with SIEMs. Log settings are done on the classification policy manager.
...
CSV or CEF format
...
Database. GEODI Logs can be used in SIEM applications.
Database Format
For other logs, you can check the GEODI Logs page.
...
Object ID | Unique ID |
|---|---|
Log Time | Time of transaction |
Log User | User who doing the classification |
Log App | GEODI |
Log App Ver | GEODI Version |
Log Module | DLP Classifier |
Log Security Level | https veya http |
Log Level | medium |
File | UNCPath of classified content |
Example: C:\Users\<user>\Desktop\ |
New Word |
Doc (2).docx |
Previous Class | Current Class (value = “?” for content without a class) |
|---|---|
Class | Given Class |
Source | Method of classification (Shell/Add-In) |
Client IP | Client IP |
|---|
Client User |
|---|
Process Memory(Kb)
The memory used on the system at the time the log was written.
Process Max Memory(Kb)
Client Username | |
AutoClass | If the AutoClass column is used as an automatic recommendation or forcibly, the ID value of the class determined automatically is provided. If automatic classification has never been used, it will be logged as empty. |
Action Type |
|
|---|
Database format
|
...
Object ID
Unique ID
Log Time
time of transaction
Log User
user who doing the classification
Log App
GEODI
Log App Ver
GEODI Version
Log Module
DLPClassifier
Log Security Level
https veya http
Log Level