How to determine when a policy was changed and by whom in the DLP Enforce console
search cancel

How to determine when a policy was changed and by whom in the DLP Enforce console

book

Article ID: 164395

calendar_today

Updated On:

Products

Data Loss Prevention Enforce

Issue/Introduction

Policy information indicates that it was changed. Is there a way to determine who changed it and when?

Resolution

The steps are as follows:

1. In the Enforce Console navigate to the system events page by navigating through the following path to System -> Servers and Detectors -> Events

2. Expand the filters by clicking on Advanced.

3. Click Add filter button which will be shown on the right hand side of the screen.

3. Select Event Code - Is Any Of and enter 2116 into the entry field.

4. Click on the Apply button to filter the events for ones like these: 

 
Code 2116 - Policy changed
Summary: Updated policy <name>
Details: <who changed the policy>
 
If required, change the date range to one of the present ranges or a custom date range.

 

Alternatively the date of the last change in a policy will be shown in the Last Modified column in the Policy List which can be reached in the Enforce Console by navigating to Manage -> Policies. Although it will only show the last update, the method described above allows to track the history of policy updates.

Information about the user making the last change can be reviewed by opening the policy details by clicking on the name of the policy. The Last Modified field will show the Last Modified date along with the user name who made the change: