Approving or denying scoped investigations

If you are an approver, your avatar on left-hand sidebar of the FortiDLP Console will display a blue circle to indicate when there are investigation requests requiring review. To see the requests, just click your avatar and select the Pending investigation requests menu option to go to the Scoped investigations page.

Approver's pending investigation requests

Alternatively, you can view requests via Admin settings.

The following instructions describe how to approve or deny scoped investigation requests using either method.

Approvers are not permitted to approve investigation requests they have created. Scoped investigations cannot be modified after approval.

How to approve or deny a scoped investigation

1. In the FortiDLP Console, do one of the following:
   • To view requests via your avatar:
     1. On the left-hand sidebar, click your avatar.
     2. In the menu, click Pending investigation requests.
   • To view requests via Admin settings:
     1. On the left-hand sidebar, click .
     2. Under General, select the Scoped investigations tab.
2. In the All scoped investigations table, click the investigation's table row.
3. In the Review investigation dialog box, do one of the following:

• To approve the investigation access requested:
  1. Click Next.
  2. Set the expiry of the investigation by either selecting a time preset or entering a custom expiry.
  3. In the Comments field, type additional details for the investigator.
     
  4. Click Approve.
• To alter the investigation access requested before approving it:
  1. Modify the scope of the investigation, referring to Assigning scoped investigations for detailed instructions.
  2. Click Next.
  3. Set the expiry of the investigation by either selecting a time preset or entering a custom expiry.
  4. In the Comments field, type additional details for the investigator.
     
  5. Click Approve.
• To deny the investigation access requested:
  1. Click Deny.
  2. In the Comments field, type additional details for the investigator.
     
  3. Click Deny.