Monitoring the system consists of gathering and reviewing evidence and events, and producing reports.
Incident and event data from the DLP tables in the ePO - On-prem database is viewed in the DLP Incident Manager and DLP Operations pages or is collated into reports and dashboards. User information is collated on the User Information tab of the DLP Operations module, and can be exported to a .csv file.
Administrators review recorded events and evidence to determine when rules are too restrictive and cause unnecessary work delays, or when they are too lax and allow data leaks.