When PortalProtect detects a file that matches your blocking configuration, it executes an action to protect your SharePoint environment. The type of action it executes depends on the type of scan it is performing (real-time, manual, or scheduled) and the type of actions you have configured for that scan (block or pass). Each time PortalProtect executes an action, it logs the event. You can view these from the Logs menu. See Query Logs for more information.