The template project for the Classification project and Log Analysis Panel comes ready with the Classification module installation. In projects where classification activities are monitored, classification movements are recorded regularly. These classification logs can be written to a database and monitored and analyzed by any SIEM tool or Log Analysis Panel.
Logs may be in CSV, CEF, syslog, or Database.
GEODI Log Analysis Panel
With the Log Analysis panel, you can monitor your classification activities and perform analysis on a user and class basis. The panel requires the logs to be in a Database.
Once you install the Classification Module, your project will be automatically activated.
You can review the following information via the panel:
Classes
Number of Classifications by Applications
Number of Classifications by Users
Classified Contents
Trend analysis number of classification by Month, Week, Year
Any user in ACC.Classifier group will see the dashboard.
It will process the data contained within the GEODI log records. New log entries will continue to be automatically processed according to the defined scan for changes.
Example Classification Panel
Log format settings and SIEM Applications
You can use GEODI Logs in SIEM applications.
Database Format
When Classification Logs are written to the Database, the following information is written.
For other logs, you can check the GEODI Logs page.
Object ID | Unique ID |
|---|---|
Log Time | time of transaction |
Log User | user who doing the classification |
Log App | GEODI |
Log App Ver | GEODI Version |
Log Module | DLPClassifier |
Log Security Level | https veya http |
Log Level | medium |
File | UNCPath of classified content Örnek: C:\Users\<user>\Desktop\Yeni Microsoft Word Belgesi (2).docx |
PreviousClass | Current Class (value = “?” for content without a class) |
Class | Given Class |
Source | Method of classification (Shell/Add-In) |
ClientIP | Client IP |
ClientUser | Client User Name |
AutoClass | If the AutoClass column is used as an automatic recommendation or forcibly, the ID value of the class determined automatically is provided. If automatic classification has never been used, it will be logged as empty. |
ActionType |
|