I am running an issue for now. I try to capture all events which are in violation of the configured policies.
Using the document classification feature of the CA DATAMINDER i can capture all events containing some keywords defined into the document classification.
The CFSA can detect files being copied from the local drive to network locations , but it doesn't capture these files when being copied from the network locations into the local drive (C OR D).
I have tried to include the C and D as removable devices, howerver the issue is still running. I configured this by going to the client common policies and in the "target as removable devices" i include "C:/" and "D:/", but it doesn't function.
Kindly asking for your help
Thanks and best regards