Evaluating Spirion Results in Windows

  1. You will receive an email from the Spirion Enterprise Console with the results of the PSI scan on your computer.  If you are trying to evaluate the results of a scan that was not initiated by the management console, but instead run by yourself see our other documentation on evaluating scan results from the Windows client.

    Evaluating Scan Results Using the Spirion Client on Windows

Image of Identy Finder Results Email in an Inbox
  1. Open the email, right click the attachment, and select “Save As”.
Image Showing How to Right Click and Select Save As for the Attachment
  1. Browse to wherever you would like to save the file, name the file, and click “Save”.
Image of Showing Where to Name the File and How to Save It
  1. Browse to where you saved your file and open it by double clicking it.
Image Showing The Now Saved File in Windows Explorer
  1. The document will look something like this when you first open it. Feel free to resize the columns.

Image Showing the Results of the Identity Finder Scan in Excel

  1. These are the columns we are mainly interested in.

     Image Showing the Results of the Identity Finder Scan in Excel With Emphasis on Some Columns

  1. The “Owner” column lists the owners of each document that has been flagged as possibly containing sensitive information.
  1. The “Identity Type” column lists the type of information the scan believes it has found.
  1. The “Identity Match” column lists the whole or partial data of the sensitive information it believes it found in a file. (Ex. It may list a full social security number or just a partial number.)
  1. The “Match Quantity” column lists how many times the information in question was found in the file.
  1. The “Location” column lists the location of the file on the computer.
  1. The “Location Type” column lists the type of document containing the information.
  1. You will now look through all of the results to determine if the information found is truly PSI as defined by the IT Policy  or if it is just a false positive.
  1. Start by right clicking the “Location” cell of the first result and selecting “Copy”.
Image Showing the Location Cell of the Spread Sheet After Right Clicking it to Bring Up More Options
  1. Next open a Windows Explorer window. Do this by clicking the Windows Explorer Icon in Windows 7 or it can be done by opening “My Computer”.
Image Showing How to Access Windows Explorer
  1. Paste the location you copied from your document into the browser bar by first left clicking it to select the bar, then right clicking the bar and selecting “Paste”.
Image Showing Where to Right Click and Paste the Location Information From the Clipboard
  1. Once the file path is in the browser bar press the “Enter” key to open the document.
Image Showing the Pasted Location Information in the Windows Explorer Address Bar
  1. Here is the document opened in the example. At first glance you can tell it contains PSI and is not a false positive.
Image Showing PSI Found in an Excel Spreadsheet
  1. Say you determine that you do not need this PSI on your machine therefore you will delete it.
  1. Close the document then repeat steps 14-16 to enter the location of the document in Windows Explorer again. However, instead of hitting enter this time you will select the text on the right hand side of the last “\” and delete it using either the "Backspace" key, the "Delete" key, or by right clicking the selected text and clicking "Delete". This is so that you point Windows Explorer to the location of the document instead of directly to the document. Once the filename text is removed you can press the “Enter” key.
Image Showing Which Portion of the Filename Text to Remove
  1. Now locate the file, right click it, and delete it.
Image Showing How to Right Click and Select Delete the File in Question
  1. You will then click on the “Desktop” to navigate to the “Recycle Bin”.
Image Showing Where to Navigate to the Recycle Bin
  1. Right click on the “Recycle Bin” and select “Empty Recycle Bin”.

 Image Showing How to Right Click and Empty the Recycle Bin

  1. Return to my list of Spirion results repeat steps 14-17 to open the next document to be evaluated.
  1. This example is a large Excel spreadsheet. You can tell the document is fairly large due to the small scroll bar on the right. You do not see any PSI at first glance.
Image Showing the Contents of the Item
  1. To make searching for the information in question faster, go back to the Spirion scan results document to copy the information in question. This is so you can enter the data into Internet Explorer in order to try and find the information quickly and determine if it is PSI or a false positive. Right click and copy the cell in question from the Identity Match column.

Image Showing how to Copy Data from the Scan Results Spreadsheet

  1. Now go back to the file you had opened and press the “Ctrl” and the “F” key simultaneously to open the Find Bar.
Image Showing the Find Bar in Excel
  1. Right click and “Paste” the data you obtained from the spreadsheet into the Find Bar
Image Showing how to Paste Data into the Find Bar
  1. This should then take you to the section of the document that displays the data you are interested in. This is a false positive triggered by a document that was fabricated for this demonstration. False positives can either be ignored or deleted.
Image Showing How the Find Bar is Useful for Locating Information in Large Items
  1. It should be noted that using this find technique will work in most of the large documents you come across.  You should now have the tools you need to evaluate Spirion Scan Results from the .csv file.