View Email DLP Logs

1. Log in to Strata Cloud Manager.
2. Select ConfigurationSaaS SecurityData SecurityLogsEmail DLP Logs and View Logs.
3. Click Refresh to display the latest Email DLP logs.

   Refresh the logs before filtering or reviewing results to ensure you are working with the most current data.

4. Filter the logs as needed.

   • Enter an email in the search bar to filter the logs by user email.
   • For Duration, choose Past 24 Hours, Past 7 Days, Past 30 Days, Past 90 Days, or Past 1 Year.
5. Review your Email DLP logs.

   In the Resources column, all SaaS Security prepends all Email DLP events with Email. For example, Email Policy, Email Content, and Email Evidence Storage.

   • Log Field Descriptions
     • Time Captured—Date and time Enterprise DLP received the forwarded email. Format is DD Month YYYY H:MM <AM or PM>.
     • Time Released—Date and time Enterprise DLP returned the forwarded email back to the next hop after successful inspection completion. Format is DD Month YYYY H:MM <AM or PM>.
     • Scan Duration—Represents the total inspection time. This period begins at Time Captured and concludes once Enterprise DLP renders a Policy Decision.
     • Message ID—Unique identifier for the email defined by RFC 5322, extracted from the email header.
     • Sender User—Email of the user who sent the email that was forwarded to Enterprise DLP.
     • Subject—Subject line of the email forwarded to Enterprise DLP.
     • Recipients—List of the target email recipient.
     • Scan Result—Displays the scan result for the forwarded email.

       • Not scanned for sensitive data—Enterprise DLP hasn't yet inspected the email.
       • Sensitive data found—Email was inspected and it contained sensitive data.
       • No sensitive data found—Email was inspected and contained no sensitive data.
     • Policy Decision—Outcome of the Enterprise DLP inspection.

       • Email matched with a DLP Data Profile in a policy and evaluation was completed—Email contained sensitive data and the action configured in the matching Email DLP policy rule was taken.
       • Email did not match with an email DLP policy—Email contained no sensitive data and can continue to the target recipient.
       • Email DLP policy evaluation timed out—Inspection skipped and the Action on Max Timeout taken because the inspection time exceeded the Max Timeout setting in the Email DLP data filtering settings.
       • Internal mail scan was disabled—Enterprise DLP didn't inspect the forwarded email because the Recipient is internal. This occurs when Enterprise DLP identifies the email as an internal email because the Sender and Recipient are registered within your onboarded Microsoft Exchange or Gmail email domains.
       • Data Loss Prevention service temporarily disabled—Email inspection failed due to the Enterprise DLP being unavailable at the time the email was forwarded.
       • Cloud Identity Engine service temporarily disabled—Email inspection failed due to the Cloud Identity Engine being unavailable at the time the email was forwarded.
       • DLP scan was skipped because maximum message size was exceeded—Inspection skipped and the Action on Oversized Message taken because the email exceeded the Maximum Size to Scan setting in the Email DLP data filtering settings.
     • Message Size—Total size of the forwarded Email.
     • Attachment—Displays Yes if the forwarded email included one or more attachments. Displays No if email didn't include an attachment.
     • Delivery Status—Current status of the forwarded email. Can display Scan Pending, Delivery Pending, Delivered, or

       • Scan Pending—Email successfully forwarded to Enterprise DLP and is pending inspection.
       • Delivery Pending—Email successfully inspected and is pending return back to the email host or quarantine inbox for review by an email administrator.
       • Delivered—Email successfully delivered to the next hop.
       • NDR Sent—Non-Delivery Report (NDR) sent to email Sender because Enterprise DLP couldn't deliver the email back to the next hop after two days of re-attempts.
     • Last Updated—Date and time the Email DLP log was updated to reflect its most current status. Format is DD Month YYYY H:MM <AM or PM>.
     • Action—Inspection result verdict as defined the matching Email DLP policy rule.
     • DSN Sent—Displays Yes if Enterprise DLP sent a Delivery Status Notification (DSN) to the email Sender when email delivery to the next hop is delayed. Displays No if email delivery to the next hop on first attempt.
     • Deferred Attempts—Number of retries attempted by Enterprise DLP to deliver the email to the next hop.

6. (Optional) Retry or purge emails stuck in the outbound deferred queue.

   Only emails with a Delivery Status of Delivery Pending are eligible for these actions. Enterprise DLP automatically excludes emails not in the outbound deferred queue.

   1. For Delivery Status, choose Delivery Pending to filter the logs to emails in the outbound deferred queue.
   2. Select one or more emails from the list.
   3. Click Actions and choose one of the following:

      • Retry—Immediately retries delivery of the selected email to the next hop.
      • Purge—Permanently removes the selected email from the outbound deferred queue. Enterprise DLP immediately stops all delivery attempts for the message and does not send a non-delivery report (NDR) to the sender.

7. (Optional) Download the currently displayed list of Email DLP logs in CSV format to your local device if needed. The downloaded file reflects all the currently applied filters.