> For the complete documentation index, see [llms.txt](https://docs.guardware.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.guardware.com/documentation/insight/frequently-asked-questions/insight-v5-faqs.md). # INSIGHT v5 FAQs
How do I monitor ChatGPT and other AI tools? Classify each AI tool before monitoring it. Go to **INSIGHT → Organisation Settings → AI Usages**. Under **AI Websites** and **AI Applications**, mark each tool as **AI**, then save the changes. Review activity in **Dashboard → AI Usage Risks**. Use the time-spent, file-upload, and sensitive-prompt widgets. Drill into a widget to review the user, device, application, website, and event details. Use **Risk Summary → Usage of AI Tools** for a high-level view of corporate files uploaded to AI platforms.
How do I monitor the usage of specific websites in the dashboard? First, classify the website in **INSIGHT → Organisation Settings → Websites**. Mark it as **Organisational** or **Non-organisational**, then save the change. Use **Dashboard → Behaviour Risks → Productivity** to review time by user and website category. Use **Risk Summary → Usage of Non-Corporate Websites** for website-level usage details. For data transfers, use **Dashboard → Data Type Risks → Website Uploads**. Filter or drill down to inspect the website, user, device, file, and detected data type.
I want to monitor sensitive financial information. How do I do that? Create a User Policy that detects the required financial data types. Include relevant patterns and keywords, then assign the policy to the target users or devices. Choose **Monitor**, **Warn**, or **Block** for each monitored activity. Review events in **Dashboard → Data Type Risks → Incidents by Data Type**. Use the activity widgets to investigate website uploads, application transfers, emails, storage transfers, keystrokes, and copy-paste events. Use **AI Usage Risks** when financial data could reach AI websites or applications.
How do I track clipboard copying? INSIGHT v5 monitors copy-paste activity. Open **Dashboard → Data Type Risks → Copy Paste** to review the user, source application, target application, device, location, and detected data type. Open an event to review its screenshot and copied-content analysis. Use **Risk Summary → Copy Paste** for an overview of incidents involving non-corporate applications. Configure exclusions in **INSIGHT → Advanced Settings** when specific applications or websites should not be monitored.
How do I log and review violations? Policy events appear in **Dashboard → Data Type Risks → Incidents by Data Type**. Filter the dashboard, then drill into an incident for the user, timestamp, activity, device, file, application, and data type. Use an incident’s **ACTION** menu to review detected content or policy matches. Use the relevant activity widget to investigate its route, such as **Website Uploads**, **Application Transfer**, **Emails**, or **Copy Paste**. Use **Dashboard → System Risks → Audit Log** to review administrative and system activity.
How do I see a user’s web browsing history and time spent per site? Classify websites in **INSIGHT → Organisation Settings → Websites**. Organisational sites appear as productive. Non-organisational sites appear as unproductive. Open **Dashboard → Behaviour Risks → Productivity** to review time spent by user and website category. Use **Risk Summary → Usage of Non-Corporate Websites** for website usage details, then filter and drill down for the selected user and period.
How do we monitor chat apps and web apps (Slack, Teams, web WhatsApp)? Classify desktop chat clients in **INSIGHT → Organisation Settings → Applications**. Classify browser-based services in **Organisation Settings → Websites**. Use **Dashboard → Behaviour Risks → Productivity** to review application and website time. Review sensitive-data activity through **Data Type Risks**, including **Application Transfer**, **Website Uploads**, **Keystrokes**, and **Copy Paste**. Ensure the relevant applications and websites are included in the assigned advanced-setting monitoring scope.
How do I automate remediation (move/delete) of sensitive files? INSIGHT v5 does not move or delete files automatically after detection. Use User Policies to control monitored activity at the point of action. Configure the policy to **Monitor**, **Warn**, or **Block**. Use a separate remediation process or product to move or delete existing files.
How to speed up INSIGHT client performance? Open **INSIGHT → Advanced Settings**, then edit the setting assigned to the device. Under **Environment Settings**, set **Client Responsiveness**: * **Normal** checks every 15 minutes. * **Responsive** checks every 5 minutes. * **Very Responsive** checks every minute. Assign the setting to the required devices. Shorter intervals apply changes faster, but increase endpoint, server, and network overhead.
How to speed up reporting performance? Reporting uploads follow the client’s assigned advanced setting. Open **INSIGHT → Advanced Settings → Environment Settings** and choose an appropriate **Client Responsiveness** level. **Responsive** uploads reports every 5 minutes. **Very Responsive** uploads every minute. Assign the revised setting to the required devices. Use shorter intervals only where needed. They increase endpoint, server, and network overhead.
Does file monitoring detect documents that users send through webmail browsers, or is Email Protector required for email monitoring? Email monitoring is supported.
How should I configure organisation settings for users with flexible working hours or different shifts? You can leave the working hours setting unconfigured. The console doesn’t currently support separate schedules for different groups, so defining them can be difficult to manage. Alerts will still be generated based on the risks you configure.
Will a website appear in the Organisation Settings > Websites list if a user visits it only once? Yes. A website appears even if a user accesses it only once. However, the **Total Time Spent** value helps show how frequently or extensively it’s used.
What’s the difference between email domains and trusted email addresses in Organisation Settings? Email domains are used for your organisation’s domains. Trusted email addresses are for specific external contacts you work with, such as a supplier using Gmail.
If we already allowlist domains in the Email Domains section, what should we add as a Trusted Email address? Add the specific external email addresses you trust, such as a supplier’s Gmail address. This means GuardWare won’t alert when someone emails those addresses. For example, if your organisation has listed `yourcompany.com` in the **Email Domains** section, but you regularly exchange emails with a supplier at `suppliername@gmail.com`, add that specific address under **Trusted Emails**. GuardWare won’t alert on emails sent to or received from that address.
If Gmail is considered insecure, how can we allowlist a specific Gmail address? If Gmail is considered insecure, add the specific Gmail address you trust under **Trusted Emails**. For example, if you regularly exchange emails with `suppliername@gmail.com`, add that address to prevent alerts on emails sent to or received from it.
Can GuardWare distinguish between a legitimate email address and a fake address that looks similar? Email domains identify your organisation’s email addresses. Trusted Emails apply to an exact address: add an external address only if you don’t want alerts when someone emails it. This setting doesn’t verify whether an address is genuine or distinguish it from a lookalike address, so check the full email address carefully.
Can the INSIGHT Agent be installed on Mac or Linux devices? Currently, the INSIGHT Agent can only be installed on Windows.
How can I control USB access for selected users? Create a user policy with the required USB settings, then assign the selected users to that policy. For example, to block USB access for a particular team member, create a policy that blocks USB devices and assign that user to it.
Will the policy block a salary slip emailed to me by the Accounts department? It depends on how the policy is configured. If the policy blocks the relevant email activity, the message will be blocked. You can create a separate policy for the HR or Accounts team and set it to monitor mode if you want to allow the emails while monitoring them.
Can I apply a policy to everyone except specific users? There isn’t an option to exclude users from a policy. Instead, create separate policies and assign each to the relevant users. For example, if a department has 100 users and 10 are authorised to share confidential information, assign one policy to the 90 users and a different policy to the 10 authorised users. Configure each policy to suit their access and sharing requirements.
If I integrate Microsoft 365, will policies automatically apply to all users listed in Microsoft Entra ID? No. The integration lets you import users and security groups from your Microsoft 365 tenant. You can then assign those users or groups to the relevant policies.
Can I upload a confidential file if I change its filename to something else? If the policy analyses the file’s content, changing the filename won’t affect the result. If the policy uses a filename expression, it checks the name instead. For example, a policy set to block files with names starting with “Salary Review” will block those files from being uploaded, regardless of their content.
What happens if I email a sensitive file that’s encrypted or password-protected? GuardWare can identify encrypted, password-protected, or Microsoft Information Protection (MIP) protected files, but it can’t analyse their contents. It will flag the file and generate an alert.
Can email labels control whether a message can be sent outside our organisation? For example, can “Public” allow external sending while “Internal” blocks it? This can be configured using data types and email policies. GuardWare can block emails based on the label and recipient requirements. Contact the GuardWare team with your requirements, and they can help configure the policy.
Do advanced settings have a separate dashboard or notification area? No, there isn’t a separate dashboard for advanced settings. You can check the settings applied to a user or device in the **Users** or **Devices** sections.
--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.guardware.com/documentation/insight/frequently-asked-questions/insight-v5-faqs.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.