Reference Guide

Navigate the Dell Server
104
Protected Office Document or Basic File Protection audit events (Windows, Mac, mobile, web portal,
CASB)
This table lists audit events that apply to Office documents or other files entered in Basic File Protection:
• For Windows and Mac, audit events apply to Opt-in or Force Protected modes.
• Mobile has Opt-in mode only.
• Protected Office document audit events do not contain the Cloud Name or Cloud Action events
since protected Office documents can move to a cloud storage provider outside of the bounds
of Data Guardian. Those display for XEN audit events under Cloud_Encryption
.
• Basic File Protection events for Windows (excluding any .xen file extensions)
Actions
for
audit
events
Data Guardian
Action and
Description
Windows Mac
Mobile
device
Web
portal
CASB
Created
New
Opt-in mode - logs an event when a
user selects Save As Protected and
an Office document is protected.
Force-Protected mode - logs events
when Data Guardian performs a
sweep and creates protected Office
documents.
●
●
●
●
●
Accessed
Open
A user opened a protected Office
document.
●
●
●
●
●
Modified
Swept
For Windows, when Force Protected
is enabled, provides data about files
that were swept and converted
from unprotected to protected
Office.
●
●
Modified
Updated
Summary of the number of times a
file was changed since the last audit
data transmission.
●
●
●
●
Modified
(Data Guardian
v2.7 and earlier)
Watermarked
User printed a file or exported a file
with a watermark.
●
●
Accessed
(Windows only
with
Data Guardian
v2.7 and earlier)
Block Copy
Indicates a file where a user tried to
copy from a protected Office
document to an unprotected file
and was blocked.
●
Accessed
(Windows only
with Data Guardian
v2.7 and earlier)
Blocked Print
Indicates a file where a user tried to
print a protected Office document
and was blocked.
●
Accessed
Detected tampering
Tampering was detected in the .xen
file portion of a protected Office
document. This audit event alerts
you to the tampering, but the .xen
file cannot be repaired.
For the web portal, tampering is
●
●
●
●