You can choose to send Safetica 10 alerts to your SIEM software. Each Safetica DLP log contains an alert type number and description of the violation.
Information in this article applies to Safetica 10 or older.
This feature is only available for Safetica Enterprise.
Integration with SIEM can be set up individually for each alert in the fourth step of alert configuration:
Below, you can see an example of a Safetica DLP log sent to SIEM:
Safetica@1 Id="92334" Type="103014" User="John Smith" Computer="PC101" Details="Unprotected sensitive data leaving the endpoint. Data categories: None. This alert was sent when a large volume of categorized data not protected by DLP policies had left the endpoint. Further data may have left after the alert was sent. (Rules: eMail)"
Logs can be categorized based on the Type number. The table below lists individual Type numbers and the corresponding alert names:
|DLP policy violation
|Cumulative DLP policy violation
|Unprotected sensitive data leaving the endpoint
|Unprotected sensitive data leaving the endpoint to a specific destination
|Website access denied
|Application access denied
|Unknown device connected
|Device connection denied
|Safetica Client stopped unexpectedly
|Files moving or copying on USB disk
|Files uploaded to cloud
|Tagged files uploaded to cloud
|Tagged files sent via e-mail
|Time spent on web categories
|Received e-mails count
|Sent e-mails count
|Time spent on application categories
|Printed documents count
|Printed pages count
|Wrong password to Safetica inserted multiple times
|Database size is near the maintenance limit
|Categories update failed
|Unexpected termination of Safetica Management Service
|Insufficient space on drive for databases
|Scheduled task failed
|Incorrect license status
|Disk space of server data folder is running low
|FortiGate sync error
Encoding of the alerts with special characters
We suggest setting up the UTF-8 encoding multibyte encoding in your SIEM if you have alerts with certain accent characters sent from Safetica. Another way would be to not use these characters.