Find an owner of a Data Loss Prevention report in Enforce

Products

• Data Loss Prevention
• Data Loss Prevention Enforce

Issue/Introduction

There may be a report created in the Enforce console by one of the administrators which is still sending e-mail notifications. However, none of the current Enforce users are able to find the report in the UI. It might be that the report is owned by a user or role which is not an active Enforce user anymore and no one can recall which one it is. 

The goal is to locate the report and its owner to be able to then find it in the UI. 

Resolution

If you know a report's name, you can locate it in the DLP database via Oracle. You can connect to the DLP database via SQL Developer and look for the report using the below SQL queries as basis.

 

1.  First, run the query to find the report and its most important information in the REPORT table:
   
   SELECT NAME, PERMISSION, USERID, ROLEID, TYPE, CREATEDATE, REPORTEMAILSCHEDULEID FROM REPORT WHERE NAME LIKE '%Report name goes here%';

   You can take the report name from the notification e-mail that the report sends. 
   The meaning of the columns are:
   -NAME: report name
   -PERMISSION: whether this is a SYSTEM, PRIVATE or a SHARED report
   -USERID: which user has access to that report. Note that for SHARED reports this will be empty, as a shared report is accessible for an entire role and not just a single user. PRIVATE reports will have this populated.
   -ROLEID: which role has access to that report. Similar to USERID but for role. Will be empty for PRIVATE reports and will be populated for SHARED reports.
   -TYPE: can be DASHBOARD, SYSTEM_EVENT, AGENT_MANAGEMENT, NETWORK, ENDPOINT, DISCOVER, CLASSIFICATION, MOBILE or REST.
   -CREATEDATE: date of report creation.
   -REPORTEMAILSCHEDULEID: ID of the e-mail delivery schedule, this is an indicator of whether a report has any notification schedule configured.
   
   
2.  From the query result, find your report and note down the USERID or ROLEID values, depending on whether this is a private or shared report.
   
   
3.  If USERID was populated, run the following query to locate the user who has access to that report:
   
   SELECT NAME FROM PROTECTUSER WHERE USERID='ID from query 1 goes here';
   
   
4.  If ROLEID was populated, run the following query to locate the role who has access to that report:
   
   SELECT NAME FROM ROLE WHERE ROLEID='ID from query 1 goes here';
   
   
5.  Based on the query results, log in as either the specific user or any user which is assigned to the role which has access to the report. You can now take action on the report - delete the mail schedule, modify or delete the report altogether.