On an Endpoint Data Discovery report, or a device's EDD Summary tab, you can view a summary of the files where confidential or at-risk data was detected on a device during an EDD scan The Absolute agent process that opens and analyzes files on a device's hard drive to identify at-risk content, as defined in an Endpoint Data Discovery policy. See also DAR component.. After reviewing a file's matched content, you may find that you want to exclude the file from EDD reports. For example, you may find:
- All of the matches in a file are false positives A result on an EDD-related report or page in which a match is detected in a file, but upon further investigation, you do not consider the matched content to be at-risk data..
- The file content is permitted to reside on all scanned devices.
To exclude a file, you need to change the file's Reporting Status. There are two (2) statuses:
- Ignore on all devices: excludes the file from the EDD scan results of all devices in your account (if the file content is identical)
- Report: includes the file in all devices' EDD scan results
After you exclude a file, the file continues to be excluded from all subsequent scan results until one of the following events occurs:
- The content of the file changes
- An authorized user sets the Reporting Status of the file to Report
IMPORTANT When you change the Reporting Status of one or more files, the device's Match Score remains unchanged until the next EDD scan. After the scan, the device's Match Score calculation excludes all ignored files.
To exclude one or more files from the scan results, do the following:
- On the EDD Summary tab in a device's Device Details area, expand each section to view its files.
- Select the check box next to each file you want to exclude.
- Near the top of the page, click File Actions > Ignore on all devices.
- In the confirmation dialog, review the following details (as applicable):
- Files updated: number of files that are now ignored
- Files unchanged: number of files that were already ignored, so no changes were required
- Files ineligible: number of files that must be scanned by an EDD policy before they can be ignored
- Click Close. The Reporting Status of each ignored file is updated accordingly and the files are now excluded from EDD reports.
NOTE To exclude the selected files on other devices, the file content must be identical, not the file name. This means that even if a user changes the file name of a file, if its content is the same as the selected file, the file will be ignored.
To make a device's files eligible to be ignored, perform an EDD scan.
To include one or more files that were previously ignored, do the following:
- On the EDD Summary tab in a device's Device Details area, select the Show ignored files check box near the top of the page.
- Expand each section to view its files. Notice the values in the Reporting Status column.
- Select the check box next to each file you want to include.
- Click File Actions > Report.
- To hide any remaining ignored files on this page, clear the Show ignored files check box near the top of the page. The ignored files and the Reporting Status column are removed from each section.
The Reporting Status of each file is updated to P. If any of the files were ignored on other devices, the Reporting Status of those files are also updated to P. The files are now included in EDD reports.