One place to see what happened

The activity areas record devices being connected and refused, files being copied in each direction, threats found, and policy changes. Everything is timestamped and attributed to the computer it happened on.

• Transfers — every file copied to or from a device, with its direction, size, and fingerprint.
• Blocked attempts — where someone tried to use a device or copy a file that policy refused.
• Device activity — connections, refusals, and authorisations over time.

Reading a blocked attempt

A blocked entry means policy stopped something. It is not an error — it is the system working. A pattern of attempts from the same computer is worth investigating, as it may be a legitimate workflow you have not allowed yet.

Live monitoring

The live view shows connected devices as they attach and detach, across all your computers, so you can see activity without waiting for reports.