Understanding the Office 365 Scan Details

Products

• CASB Security Advanced
• CASB Securlet SAAS

Issue/Introduction

Why do I have failed files in the scan details of the Office 365 Securlet?

Environment

Office 365 Securlet

Resolution

The failed column represents:

• Documents that were deleted or locked whe the scan took place.  (We will retry failed files).
• Files that are > than 30 MB are not sent to DLP.
• Files marked to be retried because of throttling,429 error.
  
  

The failed files column will fluctuate with a sudden increase of new files to be scanned or as files are deleted or modified.

• Failed files are retried daily for 30 days.
• Files greater than 30 days will not be re-scanned. 
  
  

If you find a large number of failed files reported that have not cleared up over time, create a support ticket asking for details regarding these files such as:

• the number of non-recoverable files
  or
• asking for a re-scan of failed files >30 days.
  
  

A re-scan may not touch these files as only exposed files will be re-scanned and only for 30 days for email.

Remaining files includes files not matched by the DLP Scanfilter (Application Detection).  Because of this there will most likely always be files remaining to be scanned.

 

 

 

Additional Information

A feature has been requested to break down failed files in greater detail.