Scheduling scans

Running data discovery scans in product installations of build 6050 and above

Once a data source is configured successfully in the Risk Analysis module, DataSecurity Plus will automatically schedule data discovery scans. The Risk Analysis module performs two types of scans:

• Full scans: These data discovery scans are automatically scheduled when data sources are first configured in DataSecurity Plus. The full scan will run only once unless manually initiated again. In such cases, users have the option of rescanning data sources or individual shares by following the steps in the Rescanning devices and shares section on this help page.
• Incremental scans: These scans look for sensitive data in newly created and modified files. Incremental scans run once a week and cannot be initiated manually.

Note: For builds prior to 6130, incremental scans for the configured devices run once in the first week of every month.

The time it takes to complete a data discovery scan depends on the resources allocated for the data discovery scan and the volume of data to be scanned.

Viewing the scan execution history and status

You can check the status of the data discovery scan for any configured device by following these steps:

• Select Risk Analysis from the applications drop-down.
• Go to Configuration > Data Sources and select On-prem Devices or SQL Servers depending on the target device's type.
• In the Scan History column, click View Details for the data source you want to analyze the scan history for. The complete scan history for that data source, including the following details, will be displayed:
  • Start Time: The time when the scan began.
  • End Time: The time when the scan completed.
  • Scan Type: Indicates whether the scan executed was incremental or full.
  • Scan Interruption Count: The number of times the scan was interrupted due to exclusion criteria.
  • Count of Files Scanned: The total number of files scanned.
  • Total Size Scanned: The combined size of all files scanned.
  • Sensitive File Count: The number of sensitive files discovered during the scan.
  • Sensitive File Size: The combined size of all sensitive files scanned.
  • Skipped File Count: The number of files that were not scanned due to an unsupported file type or exceeding size limits.
  • Skipped File Size: The combined size of all skipped files.
  • Ignored File Count: The number of files excluded from an incremental scan because they were unchanged since the previous full scan.
  • Ignored File Size: The combined size of all excluded files from the incremental scan.

Rescanning devices and shares

If you want to update your Risk Analysis records before scheduled scans, you can manually initiate a full scan of a device or a specific share on a device.

Rescanning a device

To rescan a configured device, follow these steps:

• Select Risk Analysis from the applications drop-down.
• Go to Configuration > Data Sources and select On-prem Devices or SQL Servers depending on the target device's type.
• On the Configured Devices or Configured SQL Servers page, you'll find a list of devices. Click the Rescan Device icon in the Actions column next to your target device to start scanning and click OK. Alternatively, you can click View History and select the Scan Now option on the pop-up to rescan your on-premises devices.

Note: For on-premises devices, you will be required to choose between Full scan and Incremental scan before rescanning a device.

Rescanning a file share

Granularly, you can also manually rescan individual shares. To do so, follow these steps:

• Log in to the DataSecurity Plus web console.
• Select Risk Analysis from the applications drop-down.
• Go to Configuration > Data Sources and select On-prem Devices or SQL Servers depending on the target device's type.
• On the Configured Devices or Configured SQL Servers page, click the Edit Configuration icon in the Actions column next to the target device. This will list the configured shares on that device.
• Select the shares you want to rescan and click the Rescan Share icon in the leftmost column.
• Click OK.

Note: Server scans will be paused when individual share scans start since they take priority. You can view the status of these scans by clicking View Status at the bottom of the Configured Devices page. In the pop-up that appears, you can see the current status of all active share scans and manually stop any scan if needed.

Stopping data discovery scans

To stop a data discovery scan running on a specific device, follow these steps:

• Select Risk Analysis from the applications drop-down.
• Go to Configuration > Data Sources and select On-prem Devices or SQL Servers depending on the target device's type. In the Last Scan Status column, click Running [More info] for the data source you want to view the scan status for.
• Click Stop Scanning in the Scan Status window.

The Scan Status window also provides information on the total number of entities processed, the number of rule-matched files, the total data size processed, and more.

Note: Once stopped, data discovery scans cannot be resumed. Users can choose to initiate a new data discovery scan by following the steps in the Rescanning devices and shares section on this help page.

Scheduling data discovery scans in product installations prior to build 6050

Follow the steps below to schedule data discovery scans:

• Select Risk Analysis from the modules drop-down.
• Go to Configuration > General Settings > Schedule.
• Click + Add Schedule in the top-right corner.
• Name the schedule and include an appropriate description.
• Select the policies you want to scan.
• Select the shares you want to scan.
• Check the Enable incremental file scan box.

Best practice: Always check the Enable incremental file scan box unless it is a one-time scan. This reduces the running time by scanning only new and modified files.

• Select the Schedule Duration.
• Select the Starting Date.
• Specify the Exclusion Timing.

Tip: Data discovery by itself is a CPU-intensive task. Add the most critical business hours to timing exclusions to minimize disruptions to productivity.

• Click Add.
• Click Save.