Understanding the difference between Discover "not_finished" vs "failed" scans

Products

• Data Loss Prevention API Detection for Developer Apps Virtual Appliance
• Data Loss Prevention

Issue/Introduction

As an administrator of DLP Network Discover, the difference between "not_finished" and "failed" scans needs to be understood.

Resolution

DLP scans based on logical containers specified by the nomenclature "Content Root".  A content root is specified by the user, and can contain various types of content, but is normally segregated to a given type, such as SharePoint or CIFS.

The status of Not Finished means that DLP could not complete its scan of a given content root but did not detect a condition that would cause the content root scan to fail.  

An example of this would be when the content root has permission or security restrictions that are different throughout the subfolders or subsites.

If site \\Sharepoint1 has permissions to scan as user "admin" but subsite \\Sharepoint1\subsite1 does not allow access, DLP will mark that job as not finished, because while there were no failures in the scan, the specified Content Root could not be finished for scan.

For Failed status, this means that DLP Network Discover scanned and had access to the entire content root, but it encountered a condition with the data inside that caused the scan to be marked as failed.  This would be caused by a scenario such as a network disconnection during the scan which terminated the scan before it could complete.