INSIGHT v5 FAQs
How do I monitor ChatGPT and other AI tools?
Classify each AI tool before monitoring it. Go to INSIGHT → Organisation Settings → AI Usages. Under AI Websites and AI Applications, mark each tool as AI, then save the changes.
Review activity in Dashboard → AI Usage Risks. Use the time-spent, file-upload, and sensitive-prompt widgets. Drill into a widget to review the user, device, application, website, and event details.
Use Risk Summary → Usage of AI Tools for a high-level view of corporate files uploaded to AI platforms.
How do I monitor the usage of specific websites in the dashboard?
First, classify the website in INSIGHT → Organisation Settings → Websites. Mark it as Organisational or Non-organisational, then save the change.
Use Dashboard → Behaviour Risks → Productivity to review time by user and website category.
Use Risk Summary → Usage of Non-Corporate Websites for website-level usage details.
For data transfers, use Dashboard → Data Type Risks → Website Uploads. Filter or drill down to inspect the website, user, device, file, and detected data type.
I want to monitor sensitive financial information. How do I do that?
Create a User Policy that detects the required financial data types. Include relevant patterns and keywords, then assign the policy to the target users or devices. Choose Monitor, Warn, or Block for each monitored activity.
Review events in Dashboard → Data Type Risks → Incidents by Data Type. Use the activity widgets to investigate website uploads, application transfers, emails, storage transfers, keystrokes, and copy-paste events.
Use AI Usage Risks when financial data could reach AI websites or applications.
How do I track clipboard copying?
INSIGHT v5 monitors copy-paste activity. Open Dashboard → Data Type Risks → Copy Paste to review the user, source application, target application, device, location, and detected data type.
Open an event to review its screenshot and copied-content analysis. Use Risk Summary → Copy Paste for an overview of incidents involving non-corporate applications.
Configure exclusions in INSIGHT → Advanced Settings when specific applications or websites should not be monitored.
How do I log and review violations?
Policy events appear in Dashboard → Data Type Risks → Incidents by Data Type. Filter the dashboard, then drill into an incident for the user, timestamp, activity, device, file, application, and data type.
Use an incident’s ACTION menu to review detected content or policy matches. Use the relevant activity widget to investigate its route, such as Website Uploads, Application Transfer, Emails, or Copy Paste.
Use Dashboard → System Risks → Audit Log to review administrative and system activity.
How do I see a user’s web browsing history and time spent per site?
Classify websites in INSIGHT → Organisation Settings → Websites. Organisational sites appear as productive. Non-organisational sites appear as unproductive.
Open Dashboard → Behaviour Risks → Productivity to review time spent by user and website category. Use Risk Summary → Usage of Non-Corporate Websites for website usage details, then filter and drill down for the selected user and period.
How do we monitor chat apps and web apps (Slack, Teams, web WhatsApp)?
Classify desktop chat clients in INSIGHT → Organisation Settings → Applications. Classify browser-based services in Organisation Settings → Websites.
Use Dashboard → Behaviour Risks → Productivity to review application and website time. Review sensitive-data activity through Data Type Risks, including Application Transfer, Website Uploads, Keystrokes, and Copy Paste.
Ensure the relevant applications and websites are included in the assigned advanced-setting monitoring scope.
How do I automate remediation (move/delete) of sensitive files?
INSIGHT v5 does not move or delete files automatically after detection. Use User Policies to control monitored activity at the point of action.
Configure the policy to Monitor, Warn, or Block. Use a separate remediation process or product to move or delete existing files.
How to speed up INSIGHT client performance?
Open INSIGHT → Advanced Settings, then edit the setting assigned to the device. Under Environment Settings, set Client Responsiveness:
Normal checks every 15 minutes.
Responsive checks every 5 minutes.
Very Responsive checks every minute.
Assign the setting to the required devices. Shorter intervals apply changes faster, but increase endpoint, server, and network overhead.
How to speed up reporting performance?
Reporting uploads follow the client’s assigned advanced setting. Open INSIGHT → Advanced Settings → Environment Settings and choose an appropriate Client Responsiveness level.
Responsive uploads reports every 5 minutes. Very Responsive uploads every minute. Assign the revised setting to the required devices.
Use shorter intervals only where needed. They increase endpoint, server, and network overhead.
Does file monitoring detect documents that users send through webmail browsers, or is Email Protector required for email monitoring?
Email monitoring is supported.
How should I configure organisation settings for users with flexible working hours or different shifts?
You can leave the working hours setting unconfigured. The console doesn’t currently support separate schedules for different groups, so defining them can be difficult to manage. Alerts will still be generated based on the risks you configure.
Will a website appear in the Organisation Settings > Websites list if a user visits it only once?
Yes. A website appears even if a user accesses it only once. However, the Total Time Spent value helps show how frequently or extensively it’s used.
What’s the difference between email domains and trusted email addresses in Organisation Settings?
Email domains are used for your organisation’s domains. Trusted email addresses are for specific external contacts you work with, such as a supplier using Gmail.
If we already allowlist domains in the Email Domains section, what should we add as a Trusted Email address?
Add the specific external email addresses you trust, such as a supplier’s Gmail address. This means GuardWare won’t alert when someone emails those addresses. For example, if your organisation has listed yourcompany.com in the Email Domains section, but you regularly exchange emails with a supplier at suppliername@gmail.com, add that specific address under Trusted Emails. GuardWare won’t alert on emails sent to or received from that address.
If Gmail is considered insecure, how can we allowlist a specific Gmail address?
If Gmail is considered insecure, add the specific Gmail address you trust under Trusted Emails. For example, if you regularly exchange emails with suppliername@gmail.com, add that address to prevent alerts on emails sent to or received from it.
Can GuardWare distinguish between a legitimate email address and a fake address that looks similar?
Email domains identify your organisation’s email addresses. Trusted Emails apply to an exact address: add an external address only if you don’t want alerts when someone emails it. This setting doesn’t verify whether an address is genuine or distinguish it from a lookalike address, so check the full email address carefully.
Can the INSIGHT Agent be installed on Mac or Linux devices?
Currently, the INSIGHT Agent can only be installed on Windows.
How can I control USB access for selected users?
Create a user policy with the required USB settings, then assign the selected users to that policy. For example, to block USB access for a particular team member, create a policy that blocks USB devices and assign that user to it.
Will the policy block a salary slip emailed to me by the Accounts department?
It depends on how the policy is configured. If the policy blocks the relevant email activity, the message will be blocked. You can create a separate policy for the HR or Accounts team and set it to monitor mode if you want to allow the emails while monitoring them.
Can I apply a policy to everyone except specific users?
There isn’t an option to exclude users from a policy. Instead, create separate policies and assign each to the relevant users. For example, if a department has 100 users and 10 are authorised to share confidential information, assign one policy to the 90 users and a different policy to the 10 authorised users. Configure each policy to suit their access and sharing requirements.
If I integrate Microsoft 365, will policies automatically apply to all users listed in Microsoft Entra ID?
No. The integration lets you import users and security groups from your Microsoft 365 tenant. You can then assign those users or groups to the relevant policies.
Can I upload a confidential file if I change its filename to something else?
If the policy analyses the file’s content, changing the filename won’t affect the result. If the policy uses a filename expression, it checks the name instead. For example, a policy set to block files with names starting with “Salary Review” will block those files from being uploaded, regardless of their content.
What happens if I email a sensitive file that’s encrypted or password-protected?
GuardWare can identify encrypted, password-protected, or Microsoft Information Protection (MIP) protected files, but it can’t analyse their contents. It will flag the file and generate an alert.
Can email labels control whether a message can be sent outside our organisation? For example, can “Public” allow external sending while “Internal” blocks it?
This can be configured using data types and email policies. GuardWare can block emails based on the label and recipient requirements. Contact the GuardWare team with your requirements, and they can help configure the policy.
Last updated