Detections
The Detections page shows files found that have sensitive data or are malicious.
Data Inspector continually scans your system for new files. You will receive an alert on the page as new issues are found. Up to 10,000 detections can be displayed.
Three tabs on this page show the status of each file.
Unresolved – Files identified by Barracuda Data Inspector as malicious or containing sensitive data that have not yet been remediated.
In Progress – Remediation actions have been taken on the files shown here. (See Remediate below to learn more.) This is a temporarily location. As the action on each file completes, it is moved to the Resolved tab.
Resolved – Files that have been remediated. The Action column shows the remediation action performed.
Files that are Unshared are scanned again. Because the initial issue (sensitive data, malicious payload) is likely still present, these files will return to the Unresolved tab.
Table columns are:
File – A file flagged by Barracuda Data Inspector as malicious or containing sensitive content.
Platform – The infrastructure holding the file. This will be either Microsoft OneDrive or Sharepoint.
Last Detected – After files are edited or changed in some way, they will be rescanned. Last Detected denotes the most recent time a file was found to be malicious or have sensitive content.
Owner/Creator – the owner or creator of the file.
Violations – The total number of malicious or sensitive content incidences in the file.
Sharing – Access granted to a file.
Private – Only accessible to the owner.
Internal – Shared with others within the organization.
External – Shared outside the organization. (Can also include sharing within the organization.)
Public – There are no restrictions to file access. Open to anyone.
Classifiers – Categories of sensitive data that describe the file.
Supported categories include credentials, credit card, license number, malicious content, passport, personal ID, personal medical ID, suspicious content, and tax ID.
The color of the classification label indicates the type of information detected.
Blue labels – Indicate the file contains sensitive information such as a license number or tax ID.
Yellow labels – Indicate sharing violations.
Red labels – Indicate that the file is malicious.
Gray labels – Indicate the file contains information from keyword or regex (regular expression) classifiers that have been set on the Classifiers page.
The number inside the classification label denotes the number of times the sensitive information was detected in the file.
Action – This column is found on the In Progress and Resolved tabs and shows the remediation action taken.
Filtering Page Results
There are multiple tools to help limit the files displayed to only those you are interested in. Up to 10,000 can be displayed at one time.
Search with Keywords and Filters
Combine keyword-based searches and attribute-based filters to narrow down detection results. Click on the filed that shows Click to search by keyword or apply filters to get started.
A box opens that provides options to refine search results. The first dropdown list of options is Type, which can be set to one of these:
Search – Scope and Keywords are used to narrow results.
Filter – Scope, Value, and value Condition are used to narrow results.
Once a Type is selected, the Scope dropdown becomes active. Options differ depending on the Type selected.
If the Type is Search, the Scope options are:
File Name – The name of the file.
Owner – Person or entity that owns the file.
File Path – URL of the file.
File Extension – File type extension (e.g., .exe, .pdf).
Creator – The maker of the file.
If the Type is Search, the Scope options are:
Platform – Platforms are either OneDriveConnector or SharepointLibraryConnector.
Sharing – Narrow results by file sharing options.
Classifiers – Narrow results by the classification of the file content issues.
The Condition dropdown is active if the Type selected is Filter. Conditions can be either of these:
Contains – Filter for files that contain the Values attributes selected in the final box.
Is equal to – Filter for files with the attributes exactly equal to the Values selected in the final box.
The final box will either be a Keyword entry filed or a dropdown list of Values. If the Type selected is Search, enter Keywords to match file content. If the Type selected is Filter, choose from a dropdown list that will differ depending on the Scope selected.
Using More than One Search/Filter
Click on the plus sign to the left of the filter row to add another row. Up to three Filter rows and one Search row can be added at a time. Each Scope can only be used once. (Example: you cannot create two filters that both use the Sharing Scope.)
Remove a Search/Filter row by clicking the minus sign to the left of the row.
Date Range
Limit page results to those that occurred in a given time period.
Click the calendar icon on the Date Range field to open the date range selector. Click on one of the built in presets at left (i.e. Last 3 Days, Last 30 Days, etc.) or select a range by clicking on the days in the calendar.
Sort by Column
Click the top of the File, Last Detected, or Violations columns to sort. File will sort by file names alphabetically. Last Detected is the default and sorts most recent to least recent. Violations sorts the table from the files with the fewest to the most violations. Clicking a second time on any of these will reverse the order (i.e. least recent to most recent).
Limit the Columns Displayed
Click the Edit columns button 
View File Details
Click on one of the table rows to see the details of that file.
Other Detections Page Options
Click the reload icon to view the latest file detections. Note: any implemented text search, selected filters, or date ranges will be retained. To restore detection results to default, reload the browser window.
The button will export up to 10,000 activities and will be limited by any active searches, filters or date ranges.
Click the back < or forward > arrows or one of the numbers at the bottom to view another page of file detections. The number of files shown per page can be changed via the dropdown menu .
Remediate Files
Click the Remediate button to manage files found to be malicious or have sensitive data. There are four actions that can be taken:
Quarantine – Moves the file to a Quarantine directory with limited access. Within the Detections page it transfers from the Unresolved tab to the In Progress tab. Once the action is complete, it transfers again from In Progress to Resolved.
UnShare – Changes the file access permissions to Private and transfers it from the Unresolved tab to In Progress and finally to Resolved once the action is complete. At that point only the file owner will have access to it. Once this is done, Barracuda Data Inspector will rescan the file. If it is malicious or still contains sensitive data, it will again be added to Detections as Unresolved.
Dismiss – Transfers the file to the Resolved tab without changing anything else. This would generally be used when the file is determined to be ok as it is.
Delete – Moves files to the user's Recycle Bin. Files in the Recycle Bin will not be scanned, but can be recovered if needed.