Approving or denying scoped investigations

If you are an approver, the icon on the top menu bar of the FortiDLP Console will display a blue circle to indicate when there are investigation requests requiring review. To see the requests, just click the icon and select the Investigation requests menu option to go to the Scoped investigations tab.

Alternatively, you can view requests in the Scoped investigations tab via Admin settings.

The following instructions describe how to approve or deny scoped investigation requests using either method.

Approvers are not permitted to approve investigation requests they have created. Scoped investigations cannot be modified after approval.

How to approve or deny a scoped investigation

1. In the FortiDLP Console, do one of the following:
   • To view requests from the Notifications menu:
     1. On the top menu bar, click .
     2. In the menu, select Investigation requests.
   • To view requests via Admin settings:
     1. On the left-hand sidebar, click .
     2. Under General, select the Scoped investigations tab.
2. In the All scoped investigations table, click the investigation's table row.
3. In the Review investigation dialog box, do one of the following:

• To approve the investigation access requested:
  1. Click Next.
  2. Set the expiry of the investigation by either selecting a time preset or entering a custom expiry.
  3. In the Comments field, type additional details for the investigator.
     
  4. Click Approve.
• To alter the investigation access requested before approving it:
  1. Modify the scope of the investigation, referring to Assigning scoped investigations for detailed instructions.
  2. Click Next.
  3. Set the expiry of the investigation by either selecting a time preset or entering a custom expiry.
  4. In the Comments field, type additional details for the investigator.
     
  5. Click Approve.
• To deny the investigation access requested:
  1. Click Deny.
  2. In the Comments field, type additional details for the investigator.
     
  3. Click Deny.