Either a:

• system administrator who maintains a FortiDLP deployment, or

• security analyst, Fortinet cyber analyst, or other person who uses FortiDLP to protect an organization's computer networks, systems, and data.

An employee, contractor, partner, or other person who uses a computer that the FortiDLP Agent monitors.

A computer or server that the FortiDLP Agent monitors.

An unidentified device that communicates with a managed node.

A user, managed node, or external host.

An activity occurring on a managed node.

If web monitoring is enabled, a browser event is recorded each time a user visits a URL, uploads a file, and downloads a file.

A suspicious activity occurring on a managed node that:

• deviates from the norm based on historical data (behavioral analytics detection)

• breaches corporate security policies (policy detection), or

• indicates node inactivity (Agent offline detection).

A policy detection could indicate when a user attempts to copy a sensitive file to a USB storage device.