DLP Incidents by User Widget

This widget checks the number of DLP incidents based on severity levels and managed users. Data can be filtered by severity level, as well as display the total number of new and high severity incidents triggered by specific users. By default the widget displays data from all the managed products that a user's account privileges allow. The widget shows a maximum of 50 users.

Use the Range drop-down to select the time period for the data that displays.

Click the numbers in any column to open the Incident Information screen and review the summary of incidents.

To look up a specific user, type a few characters in the User field and click Search. For example typing ke shows all user names with ke, such as "Ken" and "Brooke". You can also type a domain and user name, such as domain1\chris.


User names must not contain the following characters: " [ ] : ; | = + * ? / \ < &> ,

Domain names must not contain the following characters: \ * + = | : ; " ? < &> ,

Click the widget settings icon on the widget to access additional settings.




Specify a new and meaningful title for the widget in the field.


Specify the time range when the DLP incidents were triggered.


Specify the data scope displayed by the widget.

  • Directly managed users

  • All managed users: Data is collected from both directly managed users and people under the directly managed users.


Specify the severity levels to filter the data.

Users to display

Specify the number of managed users to display.

Click Save to apply changes and update the widget data.