File IQ Premium Dashboards

The following File IQ dashboards are only available on the premium version of File IQ.

Edge Appliance and Volume Interaction

The Edge Appliance and Volume Interaction dashboard displays a point-in-time view of interactions between Edge Appliance and Volume instances that the File IQ Appliance collects activity on.

Use this dashboard to:

See the Edge Appliances that are interacting with a volume.
View the level of interaction between an Edge Appliance and Volume as compared to all the other Edge Appliances and volumes.
Access the data in table format and apply filters to narrow down on specific data points you want to see for Edge Appliance and volume activities.

Note: This panel can be initially slow in loading based on the amount of events. Because of this, examining longer periods can also be time-consuming. To improve loading time, select a short timeframe in the dashboard filters.

The Edge Appliance and Volume Interaction dashboard includes the following filters:

Volumes - Filter results by volume.
Edge Appliances - Filter results by Edge Appliance.
Minimum Events - Filter results by a minimum size of activity between the NEA and Volume.
Note: These filters can be set to “All” or any desired selection. For the Minimum Events filter, a value of "0” is equivalent to “All”. The maximum value is “100000000000” (100 billion events).

Dashboard displaying edge appliances and volume interactions with total event counts.

Panels

The Edge Appliance and Volume Interaction dashboard contains the following panels:

Heat-map View

This panel displays a grid with the list of Edge Appliances on the Y-Axis and the list of Volumes on the X-Axis. The intersection of X and Y is denoted by a cell. The cell contains the amount of activity between the Edge Appliance and Volume instances over the selected time period. The cell value is the number of audit events received from the Edge Appliance relating to activity that happened on the Volume from that Edge Appliance. The cell is shaded in different shades of purple, with the lightest color for low values and the darkest color for high values.

Heatmap displaying interaction data for edge appliances and volume metrics.

Detailed Table View

This panel displays a table with the following 3 columns:

Edge Appliance - an Edge Appliance that is sending audit events to the File IQ Appliance.
Volume - a volume that one or more Edge Appliances are interacting with and sending events to the File IQ Appliance.
Total Events - the number of audit events received from the Edge Appliance relating to activity that happened on the Volume from that Edge Appliance. The column is shaded in varying shades of purple, with the lightest for low values and the darkest for high values.

Filters can be applied directly to the table to focus on specific Edge Appliance and volume instances. As well as filtering for specific values.

Table displaying edge appliance and volume interaction with total event counts.

Volume Explorer Dashboard

The Nasuni File IQ Volume Explorer dashboard displays a point-in-time view of the files and directory entries within a specific volume.

Note: If you are using third-party tools that scan Nasuni volumes using a dedicated NEA, then do not connect that NEA to FIQ, because it can affect the Last Accessed time recorded by FIQ.

Use this dashboard to:

Select a volume connected to a File IQ Appliance.
Navigate the volume using its directory structure and the list of files in each directory.
Access a set of statistics and metrics for the current folder.
View NTFS access control information (ACLs) for supported volumes.

Viewing Access Control (ACL) Information

When browsing an AD-backed UniFS volume configured in NTFS exclusive mode, and on File IQ version 10.3+, the Volume Explorer dashboard displays file and directory listings with a padlock icon for items that expose ACL data.

To view ACL permissions, locate a file or directory row with a padlock icon, then click it to open the Access Control pop-up.

The Access Control pop-up displays the following information:

The file or folder name.
A list of users and groups with permissions on that object.
For the selected user or group, a permissions table indicates whether each permission is allowed or denied.

Note: The Volume Explorer Dashboard is only available on the Premium version of Nasuni File IQ. For more information, contact your Nasuni Account Manager.

The blue dashboard breadcrumbs help you navigate to a parent directory.

To quickly access other volume-related dashboards, click the dashboard buttons in the upper-right corner.

Link	Dashboard
Volume Usage	Navigate to the Volume Usage Dashboard for the selected volume.
Volume Utilization	Navigate to the Volume Utilization Dashboard for the selected volume.
Metadata Filtering	Navigate to the Advanced Filtering - File Metadata dashboard for the selected volume.

To navigate to a parent directory, click the directory breadcrumb located beneath the Volume Name and File/Directory Limit dropdowns.

A screenshot of a computer AI-generated content may be incorrect.

Volume Selection

To explore a volume, navigate to the Volume Name dropdown and choose a volume from the list.

A screenshot of a computer AI-generated content may be incorrect.

After selecting a volume, click the File/Directory Limit drop-down to set the maximum number of directories and files to display.

A screenshot of a computer AI-generated content may be incorrect.

Note: The directories and files displayed in the two table components are retrieved and sorted alphabetically. When using a limit lower than the total number of directories or files contained in a directory, only a subset of the files or directories is displayed in the table. The subset is determined by the directory name or file name independently from any sort order selected in the tables.

Directory Table

The Directory table displays the directories within the volume selected. By default, this table displays the directories of the selected volume's root folder. Use the pagination buttons below the table to view more results, or click the filter icon to search for a specific directory.

The Directory table displays the following directory information:

Column Name	Filter supported	Description
Directory Name	Yes	The directory name.
Created Date	Yes	The created date of the directory.
Modified Date	Yes	The modified date of the directory.
Access	Yes	The access control list for the group or user names associated with a directory.
'#' of Dirs	Yes	The total number of directories within the directory, including everything in subfolders, regardless of how deeply nested those folders are.
'#' of Files	Yes	The number of files contained in the directory (this is a recursive count).
Tree Size	Yes	The size of the directory and all its sub-directories and files (this is a recursive size).

File Table

The File table displays a list of files in the current directory.

To view files beyond the initial results, click the pagination buttons located below the table.

To filter for specific files, click the filter icon, enter a file name, and click OK.

A black rectangular object with white lines AI-generated content may be incorrect.

The File table displays the following file information:

Column Name	Filter supported	Description
File Name	Yes	The File name.
Created Date	Yes	The created date of the file.
Modified Date	Yes	The modified date of the file.
Owner	Yes	The owner of the file.
Size	Yes	The size of the file.

Directory Metrics

To the right of the Directory and File tables is the Directory Metrics. This view provides information on the currently selected directory.

The Directory Metrics display the following directory information:

Component	Description	Example
Tree Size	Represents the total size of the current directory and all its constituents (recursively nested directories and files).	Tree Size
Tree Size (% Volume)	Represents the total size of the current directory and all its constituents as a percentage of the volume size.	Tree Size (%Volume)
Nested Directory Count	The number of directories contained by the current folder. This is a recursive count of all the directories.	Nested Directory Count
Nested File Count	The number of files contained in the current folder. This is a recursive count of all the files.	Nested File Count
Current Level Directory Count	The number of directories contained by the current folder. This is not a recursive count of all the directories.	Current Level Directory Count
Current Level File Count	The number of files directly contained by the current folder. This is not a recursive count of all the files.	Current Level File Count
Sum of Current Level File Sizes	The total sum of file sizes directly contained by the current directory.	Sum of Current Level File Sizes
Last Modified Directory	The most recently modified time of the directory contained by the current directory.	Last Modified Directory
Last Modified File	The most recently modified time of the file contained by the current directory.	Last Modified File

Known Limitation

When using the Volume Explorer dashboard, note the following limitation:

If you drill down into a subfolder (by clicking a folder in the top panel) or navigate to a parent folder, the pagination state of both the folders (in the top panel) and files (in the bottom panel) is preserved from the previous view. This means that instead of resetting to the first page, Grafana continues displaying the same page number you were on before navigating.

As a result, you might see:

A non-intuitive result, as you are not starting from page 1 after navigation.
An empty panel occurs when the new folder does not have enough items to fill the specified page number.

Workaround

After drilling into or navigating out of a folder, use the pagination controls in each panel to return to page 1 to see the contents of the new directory.

Volume Version Explorer Dashboard

The Nasuni File IQ Volume Version Explorer dashboard allows users to view files and directory entries within a specific volume on a per-scan basis. The dashboard layout and functionality are the same as Volume Explorer, with the addition of a Scan Date field. The default time range for this field is 30 days. To select a different range, use the time picker in the top-right corner and select the desired timeframe.

The Volume Version Explorer dashboard allows users to do the following:

Select a volume connected to a File IQ Appliance.
Set a visible scan time range using the time picker.
Select a volume scan date to view. The default is the latest scan in the selected time range.
Navigate through the volume using its directory structure to visualize the list of files in each directory. The dashboard only displays the directory structure as of the selected scan date.
Visualize the statistics and metrics for the current folder.
For AD-backed UniFS volumes configured in NTFS exclusive mode, view Access Control Lists (ACLs) for files and directories at the selected scan date. Files and directories that expose ACL data are indicated by a padlock icon in the listing.
Note: ACLs for scans completed before the File IQ 10.3 upgrade are not available.

The Volume Version Explorer is located in the Metadata section of the Homepage.

Viewing ACLs Over Time in the Volume Version Explorer Dashboard

For AD-backed UniFS volumes configured in NTFS exclusive mode, and on File IQ version 10.3+, the Volume Version Explorer dashboard supports viewing ACLs as they existed at a specific historical scan date.

To view ACLs on the Volume Version Explorer dashboard, follow these steps:

Open the Volume Version Explorer dashboard.
Select an AD-backed UniFS volume configured in NTFS exclusive mode.
Use the Scan Date field to select a scan date.
The file and directory listings for that volume display padlock icons for files and directories.
Click a padlock icon to expose ACL data for the selected scan.

The ACL pop-up displays the following information:

The file or folder name.
A list of users and groups with permissions on that object.
For the selected user or group, a permissions table indicates whether each permission is allowed or denied.

The ACL pop-ups are read-only, bound to the selected scan version, and display ACLs exactly as they existed at that historical point in time. This behavior is consistent across all ACL-enabled dashboards and is useful for investigations that require determining who had access to an object at a specific point in time.

Auditing Permission Changes for a Folder

To audit permission changes across scan versions, follow these steps:

Identify two scan versions: one before and one after the change window.
In the Volume Version Explorer dashboard, select the older scan date.
Navigate to the folder path of interest.
Click the padlock icon to open the ACL pop-up for a representative file or folder and note the entries.
Switch to the newer scan version and navigate to the same folder path.
Open the ACL popup again and compare the following:
1. New or removed users or groups.
2. Changes in allowed or denied permissions.

By comparing ACL data across scan versions, you can determine how access to a file or folder changed over time.

Report History Dashboard

The Report History Dashboard displays the history of report executions, with the most recently executed reports shown first. You can access this dashboard through the Report History link on the Nasuni File IQ Grafana Welcome page.

The Report History Dashboard provides the following information:

Column Name	Description
Name	The report name as displayed in the Nasuni File IQ Report Management view.
Interval	The report interval - weekly or monthly.
Period Start	For reports based on volume activity (audit events), the period start is the start date (inclusive) for which the report is run. No value displays for reports based on volume metadata.
Period End	For reports based on volume activity (audit events), the period end is the end date (exclusive) for which the report is run. No value displays for reports based on volume metadata.
Queue Time	The time at which the report was added to the execution queue. By default, the table is sorted by queue time, with the most recently executed reports listed first.
Start Time	The time at which report execution started.
End Time	The time at which the report execution finished.
Duration	The report duration is in HH:MM (hours/minutes) format.
Status	Pending: The report has been enqueued and is awaiting execution. Running: The report is executing. Complete: Report execution has completed successfully. Cancelled: The report has been cancelled by user action. Failed: Report execution has failed.
Download	A download link displays after Nasuni Web Access is enabled and a share is configured for a CIFS report volume.
Notified	Indicates whether notifications for this report have been dispatched.

Status Inspection

The Status column provides an inspection icon. When clicked, the Dashboard presents additional state information.

For completed reports, the report archive's volume staging path is displayed, while failure information is provided for failed reports.

Time Picker

Use the time picker to customize the date range over which execution history is displayed.

Pagination

Use the pagination controls to locate a previously executed report.

User Directory Access

The User Directory Access dashboard displays the directories with the most event activity.

Note: If you are using third-party tools that scan Nasuni volumes using a dedicated NEA, then do not connect that NEA to FIQ, because it can affect the Last Accessed time recorded by FIQ.

Use this dashboard to identify:

The directory with the most activity on a volume or Edge Appliance.
How many users are active on the most active directories.

This dashboard has a 2-hour data latency and a default “Last 7 days” time range.

The filters are as follows:

Volumes - Filter the results by volume.
Edge Appliances - Filter the results by Edge Appliance.
Results Limit - Limit the number of directories displayed within the table.
Date Range - Filter includes default values from 1 to 7 days, but you can also enter a custom number of days.

Panels

This dashboard contains one panel. It displays the following information in a table format:

Edge Appliance – Name of the Edge Appliance.
Volume – Name of the volume.
Directory – Path to the directory.
Users – Number of users that have generated events within the directory.
Access Events – Number of events that have originated from the directory.

The information displayed is sorted in descending order by access events.

Volume Stats

The Volume Stats dashboard provides an overview of your volumes, displaying the size, file count, and directory count over time.

Use this dashboard to identify:

The usage summary of a volume over the last 7 days.
The largest volume.

The filters are as follows:

Volumes - Filter the results by volume.

Panels

This dashboard contains three panels. Each point on the following graphs represents an FSMS scan that has been run and completed.

The panels are as follows:

Volume Size – This panel displays the size of volumes over a selected timeframe.

File Count – This panel displays the file count of the volumes over a selected timeframe.

Directory Count – This panel displays the directory count of the volumes over a selected timeframe.

Volume Utilization

The Volume Utilization dashboard shows a hierarchical display of your volume’s folder structure with a depth of three from the most recent volume scan. Hovering over a block provides additional information on size and creation time. Clicking a directory tile opens the Volume Explorer in that specified directory.

Note: For a new directory path to appear on the UI, the volume must have changes when File IQ next scans it. If the volume remains unchanged, File IQ continues to display the information in the dashboard that precedes the path change. By default this directory path is the root of the volume.

Use this dashboard to analyze your volume utilization.

The filters include the following:

Volume Name - Filter the results by individual volume.

Panels

This dashboard contains the following two panels:

Root Directory - The user-defined root directory from which the Volume Utilization dashboard is calculated.

Volume Utilization – This panel displays a colored treemap view of the selected volume. The colors correspond to the volume size:

A close up of a number Description automatically generated with medium confidence

File Metadata Advanced Filtering Dashboard

For the complete documentation on the File Metadata Advanced Filtering Dashboard, see File IQ Advanced Filtering for File Metadata.

Volume Last Access Dashboard

The Volume Last Access dashboard displays the size and percentage of a volume that was last accessed in the last 6, 12, and 24 months. Along with the accessed volume size and percentage, you can also view the number of accessed volume directories and files.

Navigation

To view the last accessed metrics for a volume, navigate to the Volumes field in the upper-left corner and select a volume from the drop-down.

To quickly access other volume-related dashboards, click the dashboard buttons in the upper-right corner.

Link	Dashboard
Volume Usage	Navigate to the Volume Usage Dashboard for the selected volume.
Volume Stats	Navigate to the Volume Stats Dashboard for the selected volume.
Volume Explorer	Navigate to the Volume Explorer dashboard for the selected volume.

To see when the metrics were last generated, check the upper right-hand corner.

Dashboard Components

There are two main components to the Volume Last Access dashboard. The top panel shows volume access percentages as graphical metrics, while the bottom table shows only the metrics.

Top Panel

The top panel of the Volume Last Access dashboard displays the following information:

Component	Description	Example
Accessed Last 6 Months (Size)	The portion of the volume, measured by size, that was accessed in the past 6 months.
Accessed Last 6 Months (%Volume)	The percentage of the volume accessed in the last 6 months.
Accessed Last 12 Months (Size)	The portion of the volume, measured by size, that was accessed in the past 12 months.
Accessed Last 12 Months (%Volume)	The percentage of the volume accessed in the last 12 months.
Accessed Last 24 Months (Size)	The portion of the volume, measured by size, that was accessed in the past 24 months.
Accessed Last 24 Months (%Volume)	The percentage of the volume accessed in the last 24 months.
Volume Size	The total size of the volume selected.
Volume Directory Count	The total number of directories within the volume selected.
Volume File Count	The total number of files within the volume selected.

Last Access Summary Table

The Last Access Summary table presents the same information described above, displayed in a metrics-only format.

To sort the table by a specific column’s data, click the column header name.

Volume Last Modified Dashboard

The Volume Last Modified dashboard displays the size and percentage of a volume that was last modified in the last 6, 12, and 24 months. Along with the modified volume size and percentage, you can also view the number of modified volume directories and files.

Navigation

To view the last modified metrics for a volume, navigate to the Volumes field in the upper-left corner and select a volume from the drop-down.

To quickly access other volume-related dashboards, click the dashboard buttons in the upper-right corner.

Link	Dashboard
Volume Usage	Navigate to the Volume Usage Dashboard for the selected volume.
Volume Stats	Navigate to the Volume Stats Dashboard for the selected volume.
Volume Explorer	Navigate to the Volume Explorer dashboard for the selected volume.

To see when the metrics were last generated, check the upper right-hand corner.

Dashboard Components

There are two main components to the Volume Last Modified dashboard. The top panel shows volume modification percentages as graphical metrics, while the bottom table shows only the metrics.

Top Panel

The top panel of the Volume Last Modified dashboard displays the following information:

Component	Description	Example
Modified Last 6 Months (Size)	The portion of the volume, measured by size, that was modified in the past 6 months.
Modified Last 6 Months (%Volume)	The percentage of the volume modified in the last 6 months.
Modified Last 12 Months (Size)	The portion of the volume, measured by size, that was modified in the past 12 months.
Modified Last 12 Months (%Volume)	The percentage of the volume modified in the last 12 months.
Modified Last 24 Months (Size)	The portion of the volume, measured by size, that was modified in the past 24 months.
Modified Last 24 Months (%Volume)	The percentage of the volume modified in the last 24 months.
Volume Size	The total size of the volume selected.
Volume Directory Count	The total number of directories within the volume selected.
Volume File Count	The total number of files within the volume selected.

Last Modified Summary Table

The Last Modified Summary table presents the same information described above, displayed in a metrics-only format.

To sort the table by a specific column’s data, click the column header name.

Alerting Inspector

The Alerting Inspector dashboard provides detailed investigation context for the four match-based File IQ Activity Alerts:

Activity – Honeypot Files Alert
Activity – IP Subnet Alert
Activity – In Directory Alert
Activity – Presence of Extension Type Alert

Note: The Alerting Inspector dashboard is available in File IQ version 10.4.1+.

When one of these alerts fires, the email notification includes a direct link to this dashboard. It can also be accessed at any time from the Dashboards tab.

To access the Alerting Inspector dashboard, follow these steps:

Navigate to the Nasuni File IQ Edge User Interface using https://FILE_IQ_FQDN:8443, and log in as an Administrator.
Click the Dashboards tab on the left side.
Scroll down and click Alerting Inspector.

Alternatively, click the dashboard link included in any match-based alert email notification. The link opens the dashboard pre-filtered to the relevant alert.

Dashboard Filters

The following filters appear at the top of the dashboard and apply globally across all panels. Use them to narrow the data shown throughout the dashboard.

Filter	Description
Alert Name	Selects which alert to display. All panels reflect the selected alert.
Volumes	Filters panels to show only the selected Volume(s). Applies to volume-scoped alerts (Honeypot Files, Presence of Extension Type, In Directory).
Edge Appliances	Filters panels to show only the selected Edge Appliance(s). Applies to the IP Subnet Alert.
User Name	Filters the Event History table to events from the specified user(s).
Groups	Filters the Event History table to events from the specified group(s).
Client IP	Filters the Event History table to events from the specified client IP address(es). Relevant for the IP Subnet Alert.
Extensions	Filters the Event History table to events involving the specified file extension(s). Relevant for the Presence of Extension Type Alert.
Path	Filters the Event History table for events that match the specified path prefix or exact path.

Note: Changing the Alert Name filter updates all panels simultaneously. The Volumes and Edge Appliances filters are mutually applicable — only one is relevant depending on the selected alert.

Panels

Alert Status

The Alert Status panel shows the current overall firing state of the selected alert and displays the following fields:

Field	Description
Status	The current state: FIRING (red) if one or more entities are firing, NORMAL (green) if none are, DISABLED (grey) if the alert is not enabled.
Description	A brief description of what the selected alert detects.
Firing Since	The timestamp at which the alert first entered the FIRING state for the current firing episode. This field is empty if the Status field is NORMAL.

Alert Status by Entity

The Alert Status by Entity panel shows the current firing state of each volume or Edge Appliance enabled for the selected alert, and displays the following fields:

Column	Description
Entity Name	The name of the volume (for volume-scoped alerts) or the Edge Appliance name (for the IP Subnet Alert).
Status	The current state for this entity: FIRING (red), NORMAL (green), or DISABLED (grey) when the entity is enabled in the alert configuration, but the alert itself is not enabled.
Firing Since	The timestamp at which this entity first entered the FIRING state for the current episode. This field is empty if Status displays NORMAL.
Last Evaluated	The timestamp of the most recent alert evaluation for this entity.

Use the volumes or Edge Appliances filter at the top of the dashboard to narrow the list to specific entities.

Events Over Time

The Events Over Time panel is a time-series chart showing the count of matching audit events over the selected time range, broken down by entity.

Each series in the chart represents a single volume or Edge Appliance. The Y-axis shows the event count per evaluation interval; the X-axis shows time.

Use the time picker in the top-right corner of the dashboard to adjust the time range. The chart updates to reflect the selected range.

Reading the Chart

A spike in a series indicates a period of elevated matching activity for that entity.
A series remaining at zero indicates no matching events were detected for that entity during the interval.
Multiple series can be shown simultaneously. Use the volumes or Edge Appliances filter to isolate a specific entity.

Event History

The Event History section is collapsed by default. Click the section header to expand it.

This panel shows a table of individual matched audit events within the selected time range. Each row represents a single event that matched the configured alert criteria for an entity.

Columns

Column	Description
Timestamp	The date and time (UTC) at which the audit event occurred.
Entity Name	The name of the Volume or Edge Appliance that the event was associated with.
User	The user name associated with the audit event, as reported by the Edge Appliance.
Group	The user's primary group at the time of the event, as reported by the Edge Appliance.
Event Type	The type of file system operation (for example, Read, Write, Create, Delete, Rename).
Path	The full file or directory path involved in the event. For rename operations, this is the original (source) path.
New Path	The destination path after a rename operation. Empty for all other event types.
Details	Alert-specific context for the matched event. See the table below for what is shown per alert type.

Details Column — Alert-Specific Content

Alert	Details Column Content
Activity – Honeypot Files Alert	The honeypot file path that was matched.
Activity – IP Subnet Alert	The client IP address from which the event originated.
Activity – In Directory Alert	The configured directory path that the event's path matched against.
Activity – Presence of Extension Type Alert	The file extension that was matched (for example, .enc, .tar.gz).

Filtering the Event History Table

Use the filters at the top of the dashboard to drill into specific events:

Path — Show only events where the path contains or matches the specified value.
User Name — Show only events from a specific user.
Groups — Show only events from a specific group.
Client IP — Show only events from a specific client IP address (IP Subnet Alert only).
Extensions — Show only events involving a specific file extension (Presence of Extension Type Alert only).

Latest Alert Evaluation

The Latest Alert Evaluation section is collapsed by default. Click the section header to expand it.

This panel shows the most recent evaluation result for each entity enabled for the selected alert. It reflects the last time the alert engine assessed the entity, regardless of the time range selected in the time picker.

Columns

Column	Description
Entity Name	The name of the Volume or Edge Appliance.
Evaluated At	The timestamp (UTC) of the most recent evaluation.
Status	The result of the most recent evaluation: FIRING or NORMAL.
Event Count	The number of matching events detected during the most recent evaluation interval.

Note: This panel does not update when the time picker is changed. It always reflects the latest evaluation, which might be more recent than the selected time range.

Alert Configuration

The Alert Configuration section is collapsed by default. Click the section header to expand it.

This panel shows the full customer-configured settings for the selected alert at the time of viewing. It is divided into two parts: base settings that apply to the alert as a whole, and per-entity settings configured for each individual volume or Edge Appliance.

Base Settings Table

Column	Description
Alert Name	The name of the selected alert.
Enabled	Whether the alert is currently enabled.
Interval	The evaluation interval in seconds.
Repeat After	The repeat notification interval in minutes.
Webhook Enabled	Whether webhook notifications are enabled for this alert.
Footer	The custom footer text is configured for this alert, if any.

Per-Entity Settings Table

The columns displayed depend on the selected alert type.

Honeypot Files Alert:

Column	Description
Entity Name	The Volume name.
Enabled	Whether the alert is enabled for this Volume.
Honeypot File Paths	The list of exact file paths configured as honeypot files for this Volume.
Target	The configured Target mode (Any, Include, or Exclude).
Users	The list of users configured for Include and Exclude filtering, if applicable.
Groups	The list of groups configured for Include and Exclude filtering, if applicable.

IP Subnet Alert:

Column	Description
Entity Name	The Edge Appliance name.
Enabled	Whether the alert is enabled for this Edge Appliance.
Subnets	The list of CIDR subnets configured for this Edge Appliance.
Target	The configured Target mode (Any, Include, or Exclude).

Presence of Extension Type Alert:

Column	Description
Entity Name	The Volume name.
Enabled	Whether the alert is enabled for this Volume.
Extensions	The list of file extensions configured for this Volume.
Target	The configured Target mode (Any, Include, or Exclude).
Users	The list of users configured for Include and Exclude filtering, if applicable.
Groups	The list of groups configured for Include and Exclude filtering, if applicable.

In Directory Alert:

Column	Description
Entity Name	The Volume name.
Enabled	Whether the alert is enabled for this Volume.
Directory Paths	The list of directory paths configured for this Volume.
Target	The configured Target mode (Any, Include, or Exclude).
Users	The list of users configured for Include and Exclude filtering, if applicable.
Groups	The list of groups configured for Include and Exclude filtering, if applicable.

Note: The Alert Configuration panel reflects the current saved configuration. If the alert configuration has been modified since the events in the Event History were recorded, the configuration shown might not match the configuration that was active at the time of those events.

How Do I Investigate an Alert?

The following workflow is recommended when responding to a firing match-based alert:

Open the dashboard via the link in the alert email or navigate directly to it from the Dashboards tab.
Check the Alert Status to confirm the alert is still firing and note the Firing Since timestamp.
Review Alert Status by Entity to identify which specific volumes or Edge Appliances are affected.
Examine Events Over Time to understand the pattern and timing of the activity — was it a single burst, or is it ongoing?
Expand Event History and use the available filters to drill into the individual events:
- For Honeypot Files: Filter by the affected volume and review the User and Path columns to identify who accessed the honeypot file and from where.
- For IP Subnet: Filter by Edge Appliance and use the Client IP filter to identify the source address and the paths accessed.
- For In Directory: Filter by Volume and Path to confirm which directory was accessed and by which user.
- For Presence of Extension Type: Filter by extension and volume to identify which files with the monitored extension were involved, and which users created or modified them.
Check Alert Configuration to confirm the criteria that triggered the alert and verify that the Target mode and filter lists are configured as intended.