Monitor DLP events

Introduction

DLP rules configured with the monitor action allow requests but log events and store payloads in S3-compatible object storage. This guide describes how to view and analyse these events.

Viewing monitored events

1. Go to the DLP console.
2. Click Monitored Rules to access the monitored events page.

Filtering events

Use the available filters:

• Platform instance: filter by platform instance;
• Rule: filter by rule;
• Time range: filter by time period.

Event details

Each event displays:

• the request identifier;
• the rule triggered;
• the matched detectors;
• the final evaluation decision;
• the request fields that triggered the rule;
• the timestamp.

Downloading payloads

Payloads of monitored events are stored in S3-compatible object storage. Two versions are available:

• Full version: original payload without modification;
• Redacted version: payload with sensitive data masked.

1. Click a monitored event;
2. Click Download payload for the full version or Download redacted payload for the redacted version.

warning

Downloading the full payload is recorded in the audit trail. Only users with the viewer role or higher can access payloads.

Use cases

Monitoring before blocking

Before blocking requests in production, configure rules in monitor mode to measure their impact:

1. Create rules with the monitor action;
2. Publish the ruleset;
3. Over a given period (24h or 7d), review the monitored events;
4. Analyse false positives;
5. Adjust rule conditions;
6. Switch rules from monitor to block;
7. Publish a new version of the ruleset.

Compliance auditing

Use monitor mode to build an audit trail without interrupting traffic:

1. Create rules targeting data subject to compliance requirements;
2. Monitored events provide a history of requests containing this data;
3. Export redacted payloads for compliance reports.