8. Reporting (DSI)

Summary

Reporting and intelligence are essential components to a successful information security program. Smartcrypt’s data security intelligence allows enterprise security teams and audit/risk personnel to track which files were encrypted, the users who accessed them, what devices they were on, and where these events took place. This data can be reported on directly through the data security intelligence interface in the Smartcrypt Manager, picked up by a SIEM agent or retrieved via API for transformation and load to a customer data-mart.

Events

Event	Event Description
Account Transfer	Account Transfer is an event triggered when an account is logged into a new device on the first login. This event is different than a normal login because this event transfers the user's encrypted metadata to the device to be decrypted by the Smartcrypt Agent for use with Smartcrypt.
Add Certificate	When a System Administrator or Security Administrator adds a new contingency key into the system to be used with a policy, the Add Certificate event is stored by the Smartcrypt Manager.
Add Smartkey	When a user creates a new Smartkey on any device, the event is captured in the Data Security Intelligence reporting.
Allow	When a user requests access to a Smartkey, an access request is posted (and emailed) to the owner of the Smartkey. When the owner responds with an allow (giving the participant access to the Smartkey and thus decryption/encryption abilities), this event is stored noting the access being given.
Classification	Generated when a user makes any kind of classification interaction with a file. These classification events (30+) are stated in the classification policies.
Create Account	When a new user accesses Smartcrypt for the first time, the Smartcrypt Manager needs to create an account for the user. The account is created by the Smartcrypt Manager and this event captures the date and time when it occurred.
Create Assignment	A System Administrator and Security Administrator can create an Assignment for a Smartcrypt user to create a protected folder on a device. Data Security Intelligence captures this event to show when the assignment was created by the administrator and assigned to a Smartcrypt User.
Create Community	System Administrators and Security Administrators can create Community Keys within the Smartcrypt Manager based on groups of individual user objects stored in Active Directory. The event is stored in the system to capture the creation of a new Community Key being available in the system. Learn more about Community Keys here.
Create Locker	A System Administrator and Security Administrator can create a Locker on a Smartcrypt Device to create a protected folder on a device. Data Security Intelligence captures this event to show when a folder started being protected. Learn more about Lockers here.
Create Policy	A System Administrator and Security Administrator can create a policy to control how users will interact with the Smartcrypt product deployed on their desktops/servers. A Create Policy event shows the time, date, and the login information for the Administrator who defined the policy. Learn more about policies here.
Delete Assignment	A System Administrator and Security Administrator can delete an Assignment for a Smartcrypt User. Data Security Intelligence captures this event to show when a folder is stopped from being protected.
Delete Community	System Administrators and Security Administrators can delete Community keys within the Smartcrypt Manager. This is very dangerous activity to do because existing data encrypted with the community key will no longer be able to be decrypted by the Community key. This event will capture what Administrator deleted the Community Key as well as the date and time. Learn more about Community Keys here.
Delete Locker	A System Administrator and Security Administrator can delete a Locker on a Smartcrypt Device. This event does not cause the data to be decrypted in the locker, but only stops the automatic encryption from occurring on the next plain-text file discovered in the locker. Data Security Intelligence captures this event to show when a folder stopped being protected. Learn more about Lockers here.
Delete Policy	A System Administrator and Security Administrator can remove an existing policy from the system. This will remove the controls in place for the defined set up uses that were using the Smartcrypt application. The event stores the date, time and login name of the Administrator who deleted the policy. Learn more about policies here.
Deny	When a user requests access to a Smartkey, an access request is posted (and emailed) to the owner of the Smartkey. When the owner responds with Deny (blocking the participant access to the Smartkey and thus not allowing decryption/encryption abilities), this event is stored noting the access is being denied.
Discovery	When any Assignment or Locker running on a user machine discovers sensitive data, the Data Security Event captures information about the discovery of that file. Attributes included are filename, policy controlling user, device information, date and time of the event.
Discovery Classify	When any Assignment or Locker running on a user machine discovers sensitive data, the file is classified, and the Data Security Event captures information about the discovery of that file. Attributes included are filename, policy controlling user, device information, date and time of the event.
Discovery Command	When any Assignment or Locker running on a user machine discovers sensitive data, a command declared in the assignment or locker is run, and the Data Security Event captures information about the discovery of that file. Attributes included are filename, policy controlling user, device information, date and time of the event.
Discovery Encrypt	When any Assignment or Locker running on a user machine discovers sensitive data, the sensitive data is encrypted, and the Data Security Event captures information about the discovery of that file. Attributes included are filename, archive name, method of decryption, policy controlling user, device information, date and time of the event.
Issue Access Token	Smartcrypt clients need to be authenticated to communicate with the Smartcrypt Manager. The application will take care of this behavior for the user by getting an access token. The server can refuse to give any device an access token, which will force the device to be disabled. This event captures the event of a specific device communicating with the Smartcrypt Manager and receiving a token for access.
Login	When a user logs in on a device (not first time login, that is called "Account Transfer"). This event proves the user is accessing the device and authenticating with the Smartcrypt Manager.
Redaction	When any Assignment or Locker running on a user machine discovers sensitive data, the sensitive data is redacted, and the Data Security Event captures information about the redaction of that file. Attributes included are filename, archive name, method of decryption, policy controlling user, device information, date and time of the event.
Smartcrypt Show Passphrase	To allow Smartkey-encrypted archives to be decrypted by an external third-party application, a passphrase can be extracted from the archive to enable the archive to be decrypted and extracted. This event captures the user, device, time and date when the passphrase was generated for a given archive.
Smartcrypt Decrypt	When any user decrypts an archive, the Data Security Event captures information about the decryption. Attributes included are filename, archive name, method of decryption, policy controlling user, device information, date and time of the event.
Smartcrypt Encrypt	When any user encrypts an archive, the Data Security Event captures information about the encryption. Attributes included are filename, archive name, method of encryption, policy controlling user, device information, date and time of the event.
Update Community	System Administrators and Security Administrators can create Community keys within the Smartcrypt Manager based on individual user objects stored in Active Directory. Over time, access to the Community Key can change which will result in a Smartcrypt Update event being stored logging the change. Learn more about Community Keys here.
Update Locker	A System Administrator and Security Administrator can update a Locker on a Smartcrypt Device to create a protected folder on a device. The update could include which key to be used, or even what folder path to protect. Data Security Intelligence captures this event to show when a folder started being protected. Learn more about Lockers here.
Update Policy	A System Administrator and Security Administrator can update an existing policy from the system. This action has the potential to remove the controls in place for the defined setup users that were using the Smartcrypt application, or add controls to different users who were added to be incorporated into the policy. The event stores the date, time and login name of the Administrator who updated the policy. Learn more about policies here.