How DDR Works:

1. Data Analysis: DDR identifies all data across unstructured data environments and then classifies the data based on its content and context.

2. Risks Analysis: It evaluates user access, permissions, sharing and data location to identify risks related to your data.

3. Policy Enforcement: DDR applies predefined and custom security policies to protect data based on its classification and sensitivity.

4. Incident Response: Upon detecting a threat, DDR generates alerts and enables users to take remediation actions, such as moving files or revoking access.

1. Define Scopes: Specify the data sources that will be connect to.

2. Verify Configuration: Ensure that at least one data source is successfully connected. A green checkmark will confirm the completion.

Check for Incoming Events

Once the scan configuration is complete:

1. Go to Administration > Live Events Streaming to view real-time events.

1. Monitor Event Activity: Filter events by source, user name, action type (create, update, delete), and event type.

Overview Page

The Overview Page provides a comprehensive view of DDR's performance:

1. Event Statistics: Displays the number of events by source, such as Google Drive, SharePoint, OneDrive, and Box.

2. Data Source Activity: Visualizes active data sources and the volume of events generated by each.

3. Event Timeline: Shows when events occurred, helping identify peak activity periods and anomalies.

Open Risks

The Open Risks section highlights detected threats, categorised by risk type:

• Public Exposure: Identifies sensitive files accessible to external users via public links.

• External Sharing: Detects files shared outside the organisation, potentially exposing sensitive information.

• Internal Over-Sharing: Flags data with excessive permissions within the organisation.

For each risk, DDR provides detailed insights, including the file path, user activity, and recommended remediation steps.

The requested scope (read and delete)

If additional language packs are needed after the initial setup please reach out to support for assistance as each additional pack is a separate AI model that needs to be added.

Multitenancy Setup

For the multitenancy setup, we need to specify ${HOST_DOMAIN} as

For Data Detection and Response (DDR) to function effectively, the callback endpoint URL must remain open and accessible beyond just the initial setup phase. DDR relies on real-time event notifications and data stream updates, continuously sent to the callback URL. If the callback endpoint is closed or restricted after setup, DDR will fail to receive critical updates, which may result in:

• Delayed or missing alerts on data access, movement, or security threats.

• Incomplete monitoring of file lineage and activities, impacting compliance and forensic investigations.

To ensure uninterrupted functionality, organisations must configure their network to allow incoming requests to the callback URL from all necessary data sources.

Additionally, for on-premise deployments, it is critical that the webhook URL is accessible by external resources to receive notifications. If external services cannot reach the callback URL, DDR will not function correctly, leading to missed event detections and security blind spots. Network administrators must ensure the necessary firewall rules and routing configurations are in place to allow external communication with the webhook.

• Click on the Folder icon in Site and path to select a particular site to scan, or leave the path as empty to scan all sites

• Save the configuration

• Once the configuration is saved, click on the icon on the right and select Start file scan to begin the scanning

• The results can be viewed under Dashboard -> Enterprise Search

File tagging

Prerequisites

• An admin level user is required to scan and tag files in SharePoint On-Premise. The user must be a member of Site Owners Group where they have full control permissions to the SharePoint site.

• The default Getvisibility tags need to be created as a new column in their SharePoint. This process is described below:

  • In SharePoint, navigate to Documents

  • In the files view, select + Add column

  • Select Choice and then Next

  • Give the name as Classification and the choices as: Public, Internal, Confidential, Highly-Confidential. Select Save

  • Similary create Compliance and Distribution columns (if required)

  • Getvisibility and SharePoint's tags are now aligned

• When tags are written to SharePoint files automatically over the API, as the tags are added by Getvisibility, Modified By changes to System Account.

  • Getvisibility preserves the Modified date where applicable.

Supported SharePoint On-Premise versions:

The connector supports SharePoint 2013, 2016, 2019.

• In the Policy editor section, find the Select a service section, then choose IAM service, and select Next

• In Actions allowed, choose the below actions to add to the policy:

  • Read > GetUser

  • Read > GetPolicyVersion

  • Read > GetPolicy

  • Read > GetUserPolicy

  • List > ListUserPolicies

  • List > ListAttachedGroupPolicies

  • List > ListAttachedUserPolicies

  • List > ListGroups

  • List > ListUsers

  • List > ListGroupsForUser

• For Resources, choose All and select Create policy to save the new policy

Create a user

• Sign in to the AWS Management Console and open the IAM console with the appropriate admin level account

• In the navigation pane on the left, choose Users and then choose Create user

• On the Specify user details page, under User details, in User name, enter the name for the new user, example iam-connector-user and select Next

• On the Set permissions page, select Attach policies directly and choose the policy created in above steps

• Select Next

• Once the user is created, select it, and from the user page, choose Create access key

• Select Other then Next

• Enter a description if you wish and select Create access key

• The Access and Secret Access Keys have now been created. These can be downloaded as a CSV, and also copied from this section. NOTE: the secret access key cannot be viewed once you leave this page

Configuring AWS IAM connector in Dashboard

• Navigate to Administration -> Data Sources -> AWS IAM -> New scan

• Provide the access key and secret access key values generated in the above steps

• Save the configuration

• Once the configuration is saved, click on the icon on the right and select Start trustee scan to begin the scanning

• The scan results can be viewed under Dashboard -> Access Governance

Created and Last Modified: Timestamps indicating when the file was created and last modified.

• Under "Grant this service account access to the project," select role as Owner and click DONE

• Select the newly created service account and click Keys > Add Key > Create new key

• Make sure the key type is set to json and click CREATE

• The new private key pair is generated and downloaded to the machine. Note the values of private_key, client_email and client_id

• Under Grant this service account access to the project, select role as Owner and click DONE

• Select the newly created service account and click Keys > Add Key > Create new key

• Make sure the key type is set to json and click Create

• The new private key pair is generated and downloaded to the machine. Note the values of private_key, client_email and client_id

• Browse to App Registration and select New registration

• On the App Registration page enter the below information and click the Register button.

  • Name: (Enter a meaningful application name that will be displayed to users of the app)

  • Supported account types:

    • Select which accounts that the application will support. The options should be similar to the below screenshot.

    • “Accounts in this organizational directory only” can be selected:
    • Leave the Redirect URI as empty and Click Register
• Note the Application (client) ID, Directory (tenant) ID values

• Navigate to Manage -> Certificates and secrets on the left menu, to create a new client secret

• Provide a meaningful description and expiry to the secret, and click on Add

• Once a client secret is created, note its Value and store it somewhere safe. NOTE: this value cannot be viewed once this page is closed.

• Navigate to Manage -> API permissions on the left menu, and Add a permission

• Select Microsoft APIs -> Microsoft Graph

• Select Application permissions

• Permissions required

  • Scanning only:

    • Microsoft Graph > Application permissions > AuditLog > AuditLog.Read.All

    • Microsoft Graph > Application permissions > Directory > Directory.Read.All

• Once all the required permissions are added, click Grant admin consent

Configuring Azure AD connector in Dashboard

• Navigate to Administration -> Data Sources -> Azure AD -> New scan

• Provide the Directory (tenant) ID, Application (client) ID and Client Secret value generated in the above steps from the Azure application

• Save the configuration

• Once the configuration is saved, click on the icon on the right and select Start trustee scan to begin scanning

• The scan results can be viewed under Dashboard -> Access Governance

This guide will walk you through the steps for your iManage administrator to find this information and how to use it to configure the connector.

Network Access Requirement

Before you begin, ensure the Forcepoint DSPM server has network access to your on-premise iManage server's API. You may need to configure internal firewall rules to allow this connection.

Prerequisites

Before you begin, ensure you have the following:

• Administrative access to your on-premise iManage Control Center.

• The fully qualified domain name (hostname) of your on-premise iManage server (e.g., imanage.mycompany.com).

• A dedicated iManage service account with a username and password.

Part 1: Obtain Your Client ID (via iManage Control Center UI)

This step must be performed by your internal iManage administrator.

1. Log in to your on-premise iManage server.

2. Click on your username in the upper-right corner and select Control Center.

3. From the side menu, navigate to Applications.

4. Select Desktop Auth Client from the list.

5. Copy the Client ID value. This ID is used to identify the Forcepoint DSPM application to your iManage server. You will need this for Part 2 and Part 4.

Part 2: Get Access Token and Customer ID (via API)

You can use a command-line tool like curl to perform these one-time steps. Replace your.imanage.server.com with your on-premise server's actual hostname in the commands below.

A. Get Access Token

Run the following command in your terminal. Be sure to replace the placeholder values (YOUR_USERNAME, YOUR_PASSWORD, YOUR_CLIENT_ID) with your actual service account credentials and the Client ID from Part 1.

The JSON response will contain your access_token.

B. Get Customer ID

Run the next command, replacing YOUR_ACCESS_TOKEN with the access_token value you received from the previous step.

The JSON response will contain your customer_id.

Part 3: Configure iManage Roles & Permissions (via iManage Control Center UI)

This is performed in the iManage Control Center to grant the service account the necessary permissions.

1. Navigate to Control Center > Roles.

2. Create or edit the role assigned to your service account.

3. Grant the following privileges:

   • For Scanning: System Access > Read-only

   • For Tagging: Document > Import / Create

   • For Moving Files: Document > Delete

   • For Revoking Permissions: System Access > Not Read-only

Part 4: Configure the iManage Connector in Forcepoint DSPM

1. In the Forcepoint DSPM, navigate to Administration > Data Sources.

2. Find iManage in the list and click New Scan.

3. Fill in the connector configuration fields:

1. Click Save.

Part 5: Run the Scan

1. Find your newly configured iManage connection in the list.

2. Click the ... (three-dot) menu on the right.

3. Select Start trustee scan to scan permissions (Optional).

4. Once the trustee scan is complete (optional), click the ... menu again and select Start file scan to scan content.

Part 6: View Results

• Permission and access issues can be viewed in Dashboard > Access Governance (if you ran the trustee scan).

• File classification and content results can be viewed in Dashboard > Enterprise Search.

• In the Policy editor section, find the Select a service section, then choose S3 service, and select Next. Once S3 service permissions are added, next, move on to IAM service

• In Actions allowed, choose the below actions to add to the policy:

  • For scanning

    • IAM service

      • Read > GetUser

      • Read > GetPolicyVersion

      • Read > GetPolicy

      • Read > GetUserPolicy

      • List > ListUserPolicies

      • List > ListAttachedUserPolicies

    • S3 service

      • Read > GetBucketAcl

      • Read > GetBucketLocation

      • Read > GetObject

    • EC2 service

      • List > DescribeRegions

  • For revoke permissions (S3 service)

    • Permission Management > PutBucketAcl

    • Permission Management > PutObjectAcl

  • For tagging (S3 service)

    • Write > DeleteObject

    • Write > PutObject

    • Tagging > DeleteObjectTagging

• For Resources, choose All and select Create policy to save the new policy

Create a user

• Sign in to the AWS Management Console and open the IAM console with the appropriate admin level account

• In the navigation pane on the left, choose Users and then choose Create user

• On the Specify user details page, under User details, in User name, enter the name for the new user, example S3-connector-user and select Next

• On the Set permissions page, select Attach policies directly and choose the policy created in above steps

• Select Next

• Once the user is created, select it, and from the user page, choose Create access key

• Select Other then Next

• Enter a description if you wish and select Create access key

• The Access and Secret Access Keys have now been created. These can be downloaded as a CSV, and also copied from this section. NOTE: the secret access key cannot be viewed once you leave this page

Configuring AWS S3 connector in Dashboard

• Navigate to Administration -> Data Sources -> AWS S3 -> New scan

• Provide the access key and secret access key values generated in the above steps

• Click on the Folder icon in Path to select a particular bucket to scan, or leave the path as empty to scan all buckets

• Save the configuration

• Once the configuration is saved, click on the icon on the right and select Start file scan to begin the scanning

• The results can be viewed under Dashboard -> Enterprise Search

Registering a Dropbox App

• Login to Dropbox

• Go to Dropbox App Console and click Create app

• On the App Creation page enter below information and click Create app button

  • Choose an API: Most applications will use "Dropbox API"
  • Choose Access Type: Select "Full Dropbox" for complete access.
  • Name Your App and click Create app: Enter a name that will be visible to users.
• Go to the Settings tab and find app key and secret above the OAuth 2 section
• We need to set proper permissions for Dropbox app. Below you can find a list of required permissions:

  • For scanning

    • Files and Folders > files.metadata.read, files.content.read

    • Collaboration > sharing.read
• Go to the Permissions tab of the newly created App and set the following:

  • Account Info: account_info.read
  • Files and Folders: files.metadata.write, files.metadata.read, files.content.write, files.content.read
• Once permissions are set click Save button located on the black snackbar at the bottom of the window.

• Go back to Settings tab and scroll to Redirect URI section. Put here copied link from Dashboard and click Add
• Then copy App key from Dropbox App settings page and put it into App key field in Dashboard Create connection form. Similar action should be made for App secret.

Finishing creation of Dropbox connector in Dashboard

• Once done click Authorize with Dropbox button as below:
• Then you'll be redirected to 1st page to trust your application - click Continue
• Then you'll see a list of permissions app will be granted - click Allow
• Once done you'll be redirected back to Dashboard page with success message as below:
• Connection has been configured successfully

• If a specific path has not been set, the entire Data Source will be scanned.

• Metadata (path, size, format, etc.) and permissions are extracted and recorded for each file.

The scan discovery process can have the following statuses, reflecting its progress:

Not Started: Data Source has been added but the scan has not started.

Queued: Scan has been put into the queue for the execution.

Failed To Start: Scan unable to start, usually due to issues with permissions or network.

In Progress: Scan is actively running and processing data discovery.

Cancelled: Scan was manually stopped or automatically aborted.

Incomplete: Scan is partially completed but permissions to files were changed during scan.

Completed: Scan has successfully finished Discovery phase.

These statuses can be seen in the Last Scan Status column.

2) Metadata classification

This is the continuation of the Discovery process where:

• Metadata information is processed for each file that has been collected as part of the Discovery step.

• A detailed analysis of each file's metadata is performed .

3) Content Classification

• Permissions are analysed and the shared level is identified.

• A detailed analysis of each file's content is performed.

• Content is extracted and the sensitivity level and risk of each file is determined for classification.

  • This is determined by the Patterns/Detector setting and the AI Mesh

• This ensures that sensitive information is properly identified and protected.

Trustee Scan

This is a scan to determine the Users and Groups present in a Data Source.

• Metadata is extracted for each user, with specific fields depending on the data source. Some of the fields that will be picked up by the scan include Enabled, Last Login, Last Modified, etc.

The statuses for these scans are the same as for files but there are two additional ones.

Completed Only Users: The scan has been completed only for user-specific policies.

Completed Only Groups: The scan has been completed only for group-specific policies.

To see additional information on a running or completed scan click on the Scan Analytics Icon.

This will pop out the Analytics sidebar where there is information such as scan duration, how many files have been scanned, classification insights, etc.

• Browse to App Registration and select New registration

• On the App Registration page enter below information and click Register button

  • Name: (Enter a meaningful application name that will be displayed to users of the app)

  • Supported account types:

    • Select which accounts the application will support. The options should be similar to those below. Select �Accounts in this organizational directory only�:
    • Leave the Redirect URI as empty and Click Register
• Note the Application (client) ID, Directory (tenant) ID values

• Navigate to Manage -> Certificates and secrets on the left menu, to create a new client secret

• Provide a meaningful description and expiry to the secret, and click on Add

• Once a client secret is created, note its Value and store it somewhere safe. NOTE: this value cannot be viewed once you leave this page

• Navigate to Manage -> API permissions on the left menu, and Add a permission

• Select Microsoft APIs -> Microsoft Graph

• Select Application permissions

• Permissions required

  • Microsoft Graph > Application permissions > Device > Device.Read.All

  • Microsoft Graph > Application permissions > Directory > Directory.Read.All

  • Microsoft Graph > Application permissions > Group > Group.Read.All

  • Microsoft Graph > Application permissions > User > User.Read.All

• Once all the required permissions are added, click "Grant admin consent"

Azure Storage Subscription ID, Resource group and connection strings

A connection string is needed for the storage account you wish to scan.

• Login to Azure Portal

• If there are multiple tenants to choose from, use the Settings icon in the top menu to switch to the tenant in which needs to be registered to the application from the Directories + subscriptions menu.

• Browse to Storage accounts and select the account to be scanned

• Once the storage account is selected, note the Resouce group and Subscription ID values in the Overview page

• Navigate to Security + networking -> Access keys on the left menu, and click on Show on the Connection string

• Copy this Connection string value

• Access Control (IAM) Role assignment

  • In the storage account, go to Access Control (IAM) and assign Reader role to the azure app created in the first step

  • Save the changes.

Configuring Azure Files connector in Dashboard

• Navigate to Administration -> Data Sources -> Azure Files -> New scan

• Provide the Connection string value obtained from above steps

• Click on the Folder icon in Path to select a particular share to scan, or leave the path as empty to scan all shares

• Save the configuration

• Once the configuration is saved, click on the icon on the right and select Start file scan to begin scanning

• The results can be viewed under Dashboard -> Enterprise Search

• If you haven't created a Dropbox credentials yet, follow this guide to create a new Dropbox app and ensure the necessary credentials are set up.

2. Additional scope to Dropbox app

• Data streaming needs events.read scope, as shown below, setting is located under Permissions for your app in Dropbox App Console

Steps to Enable Data Streaming for Dropbox

1. From the Data Sources page, select Dropbox from the list of available data sources. In the Scan Configurations list, create a New Configuration.
2. Make sure the connection has a Name and Credentials set. Leave Path untouched. Dropbox supports only root level data streaming.
3. Enable Data streaming checkbox and copy Webhook URL
4. Go to , open app Settings for your credentials and paste previously copped Webhook URL into Webhook URIs
5. After clicking Add webhook should have status enabled
6. Click Save & Close to finalize the changes.
7. Clock icon: When data streaming is being activated, the clock icon will appear, indicating that the subscription is being processed. On completion it will show created configuration with Requested Data Streaming.

Monitoring Real-Time Events

After the subscription is activated, real-time events will start flowing into the platform, and you will be able to monitor them from various sections of Getvisibility.

Viewing Events in the Live Events Section

1. Navigate to the Live Events section under Administration to view a detailed audit log of all streaming events.
2. View streaming event details
3. It is also possible to monitor extended events.

• Select Application permission

• Select ActivityFeed.Read permission

• Permissions required

  • All the scanning permissions(https://docs.getvisibility.com/scan-with-getvisibility/configure-data-sources/onedrive)

  • Office 365 Management API ⇒ Application Permissions ⇒ ActivityFeed.Read

• Once all the required permission is added, click "Grant admin consent"

Enabling Auditing

• Sign into the Microsoft Purview portal using Microsoft Edge browser

• Select the Audit solution card. If the Audit solution card isn't displayed, select View all solutions and then select Audit from the Core section

• If auditing isn't turned on for your organization, a banner is displayed prompting you start recording user and admin activity. Select the Start recording user and admin activity banner.

• In certain cases, recoding cannot be enabled immediately and requires additional configuration. If this applies, users will be prompted to enable the customization setting. Select OK, and a new banner will appear, informing you that the process may take 24 to 48 hours to complete. After this waiting period, repeat the previous step to proceed with enabling recoding.

Steps to Enable Data Streaming for Sharepoint Online

1. Create a New Scan Configuration

1. From the Data Sources page, select Sharepoint Online from the list of available data sources. In the Scan Configurations list create New Configuration
2. Make sure the connection has a Name, Credentials are set. Then select the Path icon.

2. Pick a Folder for Real-Time Events

1. Click on the Folder icon in the Path field to select the folder you want to monitor for real-time events.

   • Magnifying glass icon: Folders with this icon next to them indicate that real-time events can be subscribed to from this directory.
2. After selecting the folder, click Save & Close to finalize the changes.
3. Clock icon: When data streaming is being activated, the clock icon will appear, indicating that the subscription is being processed. Once the subscription is activated, this icon will change to a green magnifying glass.

4. After enabling Data Streaming, the system will automatically handle the subscription to Sharepoint Online’s real-time events. There is no need to manually configure Webhooks.

Monitoring Real-Time Events

After the subscription is activated (green magnifying glass icon), real-time events will start flowing into the platform, and you will be able to monitor them from various sections of Getvisibility.

Viewing Events in the Live Events Section

1. Navigate to the Live Events section under Administration to view a detailed audit log of all streaming events.
2. In this section, you can filter and view event details

• Select Application permission

• Select ActivityFeed.Read permission

• Permissions required

  • Office 365 Management API ⇒ Application Permissions ⇒ ActivityFeed.Read

  • Microsoft Graph > Application permissions > AuditLog > AuditLog.Read.All

  • Microsoft Graph > Application permissions > Directory > Directory.Read.All

• Once all the required permission is added, click "Grant admin consent"

Enabling Auditing

• Sign into the Microsoft Purview portal using Microsoft Edge browser

• Select the Audit solution card. If the Audit solution card isn't displayed, select View all solutions and then select Audit from the Core section

• If auditing isn't turned on for your organization, a banner is displayed prompting you start recording user and admin activity. Select the Start recording user and admin activity banner.

• In certain cases, recoding cannot be enabled immediately and requires additional configuration. If this applies, users will be prompted to enable the customization setting. Select OK, and a new banner will appear, informing you that the process may take 24 to 48 hours to complete. After this waiting period, repeat the previous step to proceed with enabling recoding.

Steps to Enable Data Streaming for Azure AD

1. Create a New Scan Configuration

1. From the Data Sources page, select Azure AD from the list of available data sources. In the Scan Configurations list create New Configuration
2. Make sure the connection has a Name, Credentials are set and Data streaming is enabled.
3. Clock icon: When data streaming is being activated, the clock icon will appear, indicating that the subscription is being processed. Once the subscription is activated, this icon will change to a green magnifying glass.

4. After enabling Data Streaming, the system will automatically handle the subscription to Azure AD’s real-time events. There is no need to manually configure Webhooks.

Monitoring Real-Time Events

Once streaming is enabled, events can be monitored across multiple sections of the platform, providing comprehensive visibility into user and group activities. The Streaming tab offers an overview of essential operations, such as user and group creation, updates, and deletions.

For deeper insights, Extended Streaming Events leverage Azure AD’s audit logging functionality along with the ActivityFeed.Read permission. This enables the system to capture a broader range of event types beyond standard data streaming, including administrative actions, role changes, and authentication events.

Viewing Events in the Live Events Section

1. Navigate to the Live Events section under Administration and then to Streaming tab to view a detailed audit log of streaming events.

2. Navigate to the Live Events section under Administration and then to Extended Streaming tab to view a detailed audit log of extended streaming events.
3. In both sections, you can filter and view event details

1. From the Data Sources page, select SMB from the list of available data sources. In the Scan Configurations list Create New Configuration

1. Make sure the connection has a Name, Credentials are set. Then select the SMB share Path that is going to listen.

1. After selecting the folder, Select the Data streaming checkbox:

1. Follow the download tab link and installation instructions of SMB agent:

1. Follow installation instructions for SMB streaming agent:

SMB Agent Installation

This section addresses the different methods to install the SMB Connector on a single machine.

SMB Connector Pre-requisites:

• OS: Windows Server 2016 or later.

• Processor: 2 GHz or faster, 2 cores (64-bit processor recommended).

• Memory: 4GB RAM.

• Hard Disk: 1GB free space.

• Administrator Privileges: user needs admin permissions to install.

• must be installed.

Installation config

The SMB Connector supports various configuration options which can be specified via smb_connector_application_config.json

Manual Installation

Pre-requisites:

1. The ZIP of the installer files.

2. smb_connector_application_config.json file.

3. Windows Server machine access.

4. Admin access to install the connector.

Steps

1. Download the SMB Connector ZIP File: Obtain the ZIP file and save it to the Windows machine.

2. Prepare for Installation:

   • Unzip the contents of the ZIP file

   • Place the smb_connector_application_config.json file in the same directory as the unzipped contents.

3. Configure the Installer:

   • Edit the smb_connector_application_config.json file as needed. Use the smb_connector_application_config.json.example file in the unzipped folder if creating the configuration from scratch.

Create a folder mapping for every SMB share on the server that is to be scanned. WatchFolder should be the root directory of the share, and WebhookUrl should be from the scan configuration page for the SMB share on the GV dashboard (shown below).

• Keep useDefaultFileFilters set to false if you want all files in the share to be scanned. If set to true, the connector will only scan files supported by the GV Synergy agent for classification.

• IncludedExtensions and AdditionalFileFilters can be used if you wish to apply filters other than the defaults. IncludedExtensions supports file extensions in the format .txt, etc. AdditionalFileFilters allows for any custom file filter, including * as a wildcard

• Start the Installation:

  • Execute the install.ps1 script by right clicking and choosing Run with PowerShell

• Complete the Installation:

  • After the installation completes, the PowerShell window can be closed.

1. Save Streaming configuration

Monitoring Real-Time Events

After the subscription is activated (green magnifying glass icon), real-time events will start flowing into the platform, and you will be able to monitor them from various sections of Getvisibility.

Viewing Events in the Live Events Section

1. Navigate to the Live Events section under Administration to view a detailed audit log of all streaming events (you may specify source filter to focus only on SMB events):

• Browse to App Registration and select New registration

• On the App Registration page enter below information and click Register button

  • Name: (Enter a meaningful application name that will be displayed to users of the app)

  • Supported account types:

    • Select which accounts you would like your application to support. You should see the options similar to below. You can select “Accounts in this organizational directory only”:
    • Leave the Redirect URI as empty and Click Register
• Note the Application (client) ID, Directory (tenant) ID values

• Navigate to Manage -> Certificates and secrets on the left menu, to create a new client secret

• Provide a meaningful description and expiry to the secret, and click on Add

• Once a client secret is created, note its Value and store it somewhere safe. NOTE: this value cannot be viewed once you leave this page

• Navigate to Manage -> API permissions on the left menu, and Add a permission

• Select Microsoft APIs -> Microsoft Graph

• Select Application permissions

• Permissions required

  • For scanning

    • Microsoft Graph > Application permissions > Mail > Mail.Read

    • Microsoft Graph > Application permissions > User > User.Read.All

    • Microsoft Graph > Application permissions > DeviceManagementApps > DeviceManagementApps.Read.All

    • Microsoft Graph > Application permissions > MailboxSettings > MailboxSettings.Read

  • For tagging

    • Microsoft Graph > Application permissions > Mail > Mail.ReadWrite

• Once all the required permissions are added, Grant admin consent to them

• Select Application permission

• Select ActivityFeed.Read permission

• Permissions required

  • All the scanning permissions(https://docs.getvisibility.com/scan-with-getvisibility/configure-data-sources/sharepoint-online)

  • Office 365 Management API ⇒ Application Permissions ⇒ ActivityFeed.Read

• Once all the required permission is added, click "Grant admin consent"

Enabling Auditing

• Sign into the Microsoft Purview portal using Microsoft Edge browser

• Select the Audit solution card. If the Audit solution card isn't displayed, select View all solutions and then select Audit from the Core section

• If auditing isn't turned on for your organization, a banner is displayed prompting you start recording user and admin activity. Select the Start recording user and admin activity banner.

• In certain cases, recoding cannot be enabled immediately and requires additional configuration. If this applies, users will be prompted to enable the customization setting. Select OK, and a new banner will appear, informing you that the process may take 24 to 48 hours to complete. After this waiting period, repeat the previous step to proceed with enabling recoding.