Events related to manual (operator-initiated) and automatic (policy-initiated) actions.

You can view details including the:

• timestamp
• action type
• action result or status, and
• name of the operator or policy that executed the action.

For comprehensive information about actions, also see Actions.

Events related to application use.

You can view details including the:

• timestamp
• process name and binary signature status (signed, unsigned, or unverified), and
• window title name.

Events related to browser use, such as when a user visits a URL or uploads or downloads a file.

You can view details including the:

• timestamp
• browser name
• tab and target URLs and associated classification categories (these categories, which are mapped to NetSTAR internet classifiers, provide insight into potentially unauthorized, malicious, and careless web behavior)
• session type (private or normal)
• download or upload size
• MIME type
• danger rating, and
• transition type.

Events related to detections.

You can view details including the:

• timestamp
• detection name and description
• severity and risk score
• associated screenshots
• associated policy (if applicable), and
• tags.

For comprehensive information about actions, also see Detections.

Events related to outbound email activity.

You can view details including the:

• timestamp
• email client type
• sender email address, domain, and username
• recipient email addresses, domains, and usernames
• Cc and Bcc recipient email addresses, domains, and usernames
• subject line
• attachment filenames, and
• attachment file size.

Events related to file access, such as when a file is opened, modified, closed, executed, deleted, or renamed.

You can view details including the:

• timestamp
• filename
• file path, and
• process/child process name and binary signature status (signed, unsigned, or unverified).

During content inspection, the FortiDLP Agent examines files of interest locally. File contents are not uploaded to the FortiDLP Infrastructure.

Events collected from Google Drive.

You can view details including the:

• affected Google Drive labels
• file id, name, owner, and type
• membership change information
• visibility changes for published and unpublished documents, and
• the user that had their sharing permissions modified.

Events related to login activity.

You can view details including the:

• timestamp
• login type (login or logout)
• UID, and
• username.

When a user locks their machine, this is considered a logout event. When a user unlocks their machine, this is considered a login event.

Events related to network connections.

You can view details including the:

• timestamp
• connection type (inbound or outbound)
• process name and its binary signature status (signed, unsigned, or unverified)
• network addresses (destination and source), and
• communication protocol.

Events related to print jobs. For Windows machines, print jobs sent to local, network, and virtual printers are monitored. For macOS and Linux machines, prints jobs sent to local and network printers are monitored.

You can view details including the:

• timestamp
• file name
• number of pages
• size
• printer name, and
• printer port (Windows only).

On Windows, there is limited visibility of print jobs sent to centralized print servers. In some cases, events for print jobs that are sent to other servers on the network can be captured if the "Render print jobs on client computers" setting is enabled in the printer properties. For more information, click here. From FortiDLP Agent 10.4.0+, there is an option to turn on enhanced printing visibility which resolves this issue. For detailed information regarding printing functionality across OSs, see Print monitoring in the FortiDLP Agent Deployment Guide.

Events related to process starts.

You can view details including the:

• timestamp, and
• process/child process name and binary signature status (signed, unsigned, or unverified).

Events collected from Microsoft SharePoint and OneDrive.

You can view details including the:

• device platform
• application
• file name, type, and URL
• site URL
• user a resource was shared with, and
• old and new values of a modified resource.

Events related to USB composite and storage device use.

You can view details including the:

• timestamp
• device name, and
• device serial number, product ID, and vendor ID.