--- title: "How to Create a New Discovery or Sensitive Data Scan" url: "https://dm0bkdes5q7a2ls.productfruits.help/en/article/create-a-new-sensitive-data-scan" language: "en" last_updated: "2026-10-29T14:29:11.001Z" --- # How to Create a New Discovery or Sensitive Data Scan Sensitive Data Scans enable you to search for specific data types (social security numbers, telephone numbers, etc.) within files and folders at different locations (and take actions on them based on the playbook rule defined for them). ## Overview ### What is a Sensitive Data Scan? Spirion Sensitive Data Platform searches or "scans" your environment for personally identifiable or sensitive data using applications called **Agents**. - Scans are the searches that Agents perform on endpoints (targets) such as laptops, desktops, servers, databases, cloud locations, etc. to find either the file locations (Discovery Scan) or find specific data types (Sensitive Data Scan) within the files and folders - **Sensitive Data Scans** enable you to search for specific data types (social security numbers, telephone numbers, etc.) within files and folders at different locations (and take actions on them based on the [playbook rule](https://dm0bkdes5q7a2ls.productfruits.help/en/article/add-a-new-scan-playbook) defined for them). > A [**playbook**](https://dm0bkdes5q7a2ls.productfruits.help/en/article/working-with-scan-playbooks) is a set of rules which define the action(s) to take (redact, quarantine, shred, etc.) when Spirion Sensitive Data Platform discovers sensitive data during a scan of your environment. > > For example, a playbook action (after a scan completes) may be to **notify** specific data found by a scan to a specific department for review and remediation. ## What is a Discovery Scan? - The purpose of a Discovery scan is to **discover** the data that is assigned to the scan, but not manipulate the data discovered by the scan. - Discovery scans are performed by one or more agents. Multiple Agents are called **Discovery Teams**. See [Spirion Sensitive Data Platform: Architecture, Security, and Data Flow](https://dm0bkdes5q7a2ls.productfruits.help/en/article/spirion-sensitive-data-platform-architecture-security-and-data-flow). - A Discovery scan is similar to a Sensitive Data scan except that it does not require a [Playbook](https://dm0bkdes5q7a2ls.productfruits.help/en/article/working-with-scan-playbooks). - Discovery scans capture metadata only - **Note**: Do not confuse Discovery scans with Distributed scans. See What is a Distributed Scan? ### Differential Scanning Feature - New in version 13.4 is a feature called **Differential Scanning**. - Differential scanning is enabled by default. - For detailed information about Differential Scanning see [What is Differential Scanning and What is it Used for?](https://dm0bkdes5q7a2ls.productfruits.help/en/article/what-is-differential-scanning) ## How to Create a New Sensitive Data Scan Use the following steps to create a new sensitive data scan: 1. From the left side navigation menu select **Scans > All Scans**. ![](https://cdn-assets.productfruits.com/c2c3d4c6-cfdb-48e2-9b42-a9f748be04bd) 2. The "Scans" page opens. 3. In the top-right corner of the screen, click the **\+ Add Scan** button. 4. The "Enter a name and description" page opens. Later, you may search for your scan by name, so enter a descriptive **Name** and **Description**. 5. 1. Your name might include the type of operating system being scanned - "MAC" for macOS, or Target being scanned such as "SharePoint." 2. Also consider including terms indicating **Scan type** ("local" or "remote") and/or **Target type** ("website" for website scans) and/or **Location type** ("Custom" for custom folder list scans). 3. Some users append the date the scan was first created ("\_25Nov") 6. The page **Select what type of scan to create** opens. 7. Click the tile **Sensitive Data Scan**. 8. Click the **Next** button. 9. The **Select a Playbook to apply to the scan** page opens. 10. Choose a Scan Playbook from the list. 11. To search for a specific Playbook, type the name of the Playbook in the search box and then select the search icon. 12. On the page **Select the target type to scan**, choose a Target type. 13. Use the instructions in the following sections to configure each of the unique Target types. ### Select the Target to Scan In the following topics, note that the steps for configuring each Target type (Cloud, Files & Folders, Email, Collaboration Tools, Database, Website) are similar, but each Target type has unique settings not shared by other Target types. #### Cloud Use the following steps to configure a **Cloud** Target type (such as Amazon S3, Gdrive, Box, etc.). 1. From the page "**Select the target type to scan**" click the **Cloud** tile. ![](https://cdn-assets.productfruits.com/0e150f2b-4a6e-4dff-8dbb-cd51054a79ca) 2. On the **Select which cloud service to scan** screen, select the desired cloud platform: 3. - Dropbox - Google Drive - Box - OneDrive for Business - Amazon S3 #### Files & Folders Use the following steps to configure a **Files & Folder** Target type: 1. From the screen "**Select the target type to scan**" click the **Files & Folder** tile. **Select the Target Type Page** This page only appears for "Files & Folders" Target types. 1. The "Select a target type" page opens. 2. Select "Local Target" to select a "File & Folder" Target on your local machine or "Remote Target" to select a Target located either on your network or on a cloud source. 3. **NOTE**: When scanning Local Targets only local Agents/Targets are listed as available Targets (Agents can act as Targets as the Agent scans the machine it is installed on). 4. 1. In scans of **Local Targets**, such as desktop/laptop machines, multiple Agents of the same type (Windows or Legacy/Mac/Linux) but different version (13.1.2, 13.5.0, 13.5.1, etc.) is supported. 2. **Note**: Using multiple Agents with different versions is not supported in scans of Remote Targets. 3. **Distributed Scanning** - In scans of multiple Local Agent Target machines such as desktops/laptops, with multiple Agents assigned, each Agent, acting as a Target, scans itself. See "[What is a Distributed Scan?](https://dm0bkdes5q7a2ls.productfruits.help/en/article/what-is-a-distributed-scan)" ![](https://cdn-assets.productfruits.com/619eb5f4-5593-456a-ab17-04eca2e6727f) #### Email Use the following steps to configure an Email Target type (such as Exchange, Exchange Online, or Gmail): 1. From the screen "**Select the target type to scan**" click the **Email** tile. 2. Select an email service provider. #### Collaboration Tools Use the following steps to configure a Collaboration Target type (SharePoint, SharePoint Online, or Bitbucket): 1. From the screen "**Select the target type to scan**" click the **Collaboration Tools** tile. 2. Click the **Next** button in the bottom right corner to proceed, **Previous** button to return to the previous screen, or **Exit Without Saving** button to discard all changes. 3. On the **Select the collaboration tool to scan** screen, select one of the following options: 4. 1. **SharePoint | SharePoint Online** 2. **Bitbucket** #### Database Use the following steps to configure a Database Target type (SQL, Snowflake, Oracle, etc.): > **Note:** To establish the connection required to scan a database target, the relevant driver must be installed on the agent host system 1. From the screen "**Select the target type to scan**" click the **Database** tile. 2. On the "Select which database to search" screen, select the type of database you wish to scan. 3. - Oracle - SQL Server - Sybase - IBM DB2 - Informix - InterBase - SQLBase - SAP SQL Anywhere - MySQL - SQLite - PostgreSQL - ODBC - OLEDB - mongoDB - Snowflake #### Website Use the following steps to configure a Website Target type: 1. From the screen "**Select the target type to scan**" click the **Website** tile. 2. Click the **Next** button in the bottom right corner to proceed, the **Previous** button to return to the previous screen, or **Exit Without Saving** button to discard all changes. 3. Proceed to select the Agents to perform the scan. ### Select the Agent to Perform the Scan Screen (All Target Types) After selecting your Target type, select the Agents to perform the scan. **Note**: You cannot employ Agents on machines with different operating systems in the same scan. Windows Agents (v13 and later) cannot be combined with Legacy Agents, MacOS, or Linux Agents (pre-v13) in the same scan. This means you cannot scan Windows and MacOS with the same scan. For the purpose of organization and auditing, we recommend Agents are organized by operating system using the Tag feature and Agent naming conventions such as "Win10-VM," "Win11-Azure," etc. This step applies to all Target types: 1. Select the service and the "**Select the agent(s) to perform the scan**" screen opens. 2. From the **All On-Prem Agents** list, choose the agent(s) you want to use. 3. To expand a section, click the chevron (>) icon. Note: Learn more about the icons that appear on this page using the tooltips such as the tooltip next to "All On-Prem Agents." 4. To select an Agent, or a Tag which contains multiple Agents, click the right-pointing arrow next to the Agent or Tag name. This moves the Agent or Tag (collection of Agents) over to the **Selected On-Prem Agents** field. 5. To determine the version of an Agent, hover your mouse pointer over the information icon - the 'i' inside a ciricle. **Note**: Windows Agent versions 13 and greater cannot be combined with Legacy Agents (pre-version 13) to use in the same scan. 6. 1. If you select **more than one version** from the list of available the agents, you receive an error message (below) and are prompted to reselect your agents. 2. To remove an agent from the **Selected On-Prem Agents** field, click the left-pointing arrow next to an Agent name in that field. ### Select the Targets to Scan Screen After selecting the Agents to perform the scan, select which Targets to scan for sensitive data. This step applies to all Target types: 1. On the "**Select Targets(s) to Scan**" page, select one or more Targets to scan. 2. 1. Expand the section and add a Target. 2. To add a target, click the right-pointing arrow next to the Target name and move it to the "**Selected Targets**" field. 3. To remove a target from the **Selected Targets** section, click the left-pointing arrow next to the target name and move it back to the **All Targets** field. **Note**: To create a new Target, see [How to View Target Details and Search for a Target](https://dm0bkdes5q7a2ls.productfruits.help/en/article/data-assets-and-targets-targets). 3. Click the **Next** button in the bottom right corner to proceed, the **Previous** button to return to the previous screen, or **Exit Without Saving** button to discard all changes. #### Select SharePoint Options Screen (SharePoint Targets Only) After selecting the Targets to scan, select your SharePoint options. This step applies only to SharePoint Target types: 1. From the "Select SharePoint options" screen, select the SharePoint site content to search: 2. 1. **Documents/Files** 2. **Tasks** 3. **Calendar** 4. **Contacts** 5. **Item** \- A SharePoint item is a single data entry, like a row in a spreadsheet or a record in a database, within a SharePoint list, containing various pieces of information organized into columns (metadata) like text, numbers, or dates, allowing for collaborative data management. ![](https://cdn-assets.productfruits.com/b9c3dfc5-2855-4fa4-9bc9-0719f4d01317) 3. If applicable, click the blue **Advanced Options** button in the top right corner of the screen to add additional options. (Click the **Basic Options** button to return to the previous screen). 4. The "**Select advanced SharePoint options**" screen appears. Select the options as you desire. Use the tooltips next to each option or see the descriptions in the topic [Scan Options](https://dm0bkdes5q7a2ls.productfruits.help/en/article/scan-options). ### Select **Which User Accounts You Would Like to Scan Screen (Cloud Targets Only)** After you select the agent(s) to perform the scan, select which user accounts to scan. This step applies to **Cloud** Target types only. For all other Target types, proceed to the topic "[Select File Type Scan Options screen](https://dm0bkdes5q7a2ls.productfruits.help/en/article/create-a-new-sensitive-data-scan#select-file-type-scan-options-screen)," below. Procedure: 1. The **Select Which User Accounts You Would Like to Scan** screen opens. 2. Your cloud source brand is reflected on this screen. Note, this screen does not display for Amazon S3 cloud services. 3. - **Search**: To search for a **User Account**, enter the name into the box and click the **Search** icon or click **Enter**. - **Input the User Account to add and press Enter**: Enter the user account name and click **Enter**. - **Upload Account List**: To upload a list of accounts from your local computer, click the upload icon and locate the file on your local computer. 4. Click the **Next** button to proceed, the **Previous** button to return to the previous screen, or the **Exit Without Saving** buton to discard. ### Select File Type Scan Options Screen Next, you select the file type scan options. This step applies to all Target types. Procedure: 1. The **Select file type scan options** screen appears. 2. Select the options as you desire. These options are described in the topic [Scan Options](https://dm0bkdes5q7a2ls.productfruits.help/en/article/scan-options). 3. If applicable, click the **Advanced Options** button in the top right corner of the screen to add additional options. (Click the **Basic Options** button to return to the previous screen). 4. The **Select file type scan options - Advanced Options** screen appears. Select the options as you desire. Use the tooltips next to each option or see the descriptions in the topic [Scan Options](https://dm0bkdes5q7a2ls.productfruits.help/en/article/scan-options). 5. Click the **Next** button in the lower right corner to proceed, the **Previous** button to return to the previous screen, or the **Exit Without Saving** button to discard. ### Scan Email and Compressed Files Page Next, the page "Scan email and compressed files?" opens. This step does not apply to all Target types. 1. Select the options you desire. Use the embedded tooltips next to each option or use the descriptions in the topic [Scan Options](https://dm0bkdes5q7a2ls.productfruits.help/en/article/scan-options). 2. Click the **Next** button in the bottom right corner to proceed, **Previous** button to return to the previous screen, or **Exit Without Saving** button to discard. #### Select Exchange/Outlook options Next, the page "Select Exchange/Outlook options" opens. This step does not apply to all Target types. 1. Select the options you desire. Use the embedded tooltips next to each option or use the descriptions in the topic [Scan Options](https://dm0bkdes5q7a2ls.productfruits.help/en/article/scan-options). 2. Click the **Next** button in the bottom right corner to proceed, **Previous** button to return to the previous screen, or **Exit Without Saving** button to discard. ### Select Advanced Options The "Select advanced options" screen appears. This step applies to all Target types. 1. The **Select advanced options** screen appears. Select the options you desire from the **Advanced Options**. Use the embedded tooltips next to each option or use the descriptions in the topic [Scan Options](https://dm0bkdes5q7a2ls.productfruits.help/en/article/scan-options). ![Example - Global Ignore Lists available when creating a new Sensitive Data Scan](https://cdn-assets.productfruits.com/54cf8f26-78e7-4711-8c5f-443ed0a2489e) 2. **Scan Only Changed Files** \- This option controls the **Differential Scanning** feature. For more information, see [What is Differential Scanning and What is it for?](https://dm0bkdes5q7a2ls.productfruits.help/en/article/what-is-differential-scanning) 3. **Global Ignore Lists** - This option controls **Global Ignore Lists**. 4. 1. Note that any user who is creating or editing a Sensitive Data scan (using the "Create New Scan" wizard, for example) can view and select any of the available Global Ignore Lists shown on the "Select advanced options" page. 2. To select a Global Ignore List for your scan to use (to ignore specific sensitive data matches or data match types), expand the **Global Ignore List** section and check the checkbox next to the appropriate Global Ignore List. 3. 1. Search for the Global Ignore List or scroll down to find it, if necessary 4. Global Ignore Lists are available to be added to any scan. They do not apply to all scans, by default. 5. For more information see [How to Use Global Ignore Lists](https://dm0bkdes5q7a2ls.productfruits.help/en/article/global-ignore-lists). 5. Click the **Next** button in the bottom right corner to proceed, **Previous** button to return to the previous screen, or **Exit Without Saving** button to discard. ### Select the Scan Schedule The "Select scan schedule" screen appears. This step applies to all Target types. 1. The next screen is **Select the scan schedule**. 2. See [Select Date and Time](https://dm0bkdes5q7a2ls.productfruits.help/en/article/selectdateandtime) for how to set the date, time, and / or recurrence for a scan. 3. Click **Next** to proceed, **Previous** to return to the previous screen, or **Exit Without Saving** to discard. #### Select who should receive notification of scan completion The "Select who should receive notification of scan completion" screen appears. This step applies to all Target types. 1. On the **Who should receive notification of scan completion** screen, select how to send email notifications. 2. - I'll Manually Check My Scans Results - Send An Email Notification 3. Select a user from the drop-down list and / or type an email address in the entry field and click **Enter**. 4. To add additional email addresses, click the plus (+) icon and type the email addresses in the entry field. 5. Click **Next** to proceed, **Previous** to return to the previous screen, or **Exit Without Saving** to discard. ### Select the Search Location Type (Files & Folders only) The "Select the search location type" page appears only for Files & Folders Target types. 1. Click **Next** to proceed, **Previous** to return to the previous screen, or **Exit Without Saving** to discard. 2. On the **Select the search location type** screen, select a location type: 3. - **Full Computer Scan** - Scan all folders and files on the Target machine(s) - **Logged in User's Directory** - Scan only the configured directory of the currently logged in user. - **Cloud Storage Folders** - Spirion can search the following cloud folders (Dropbox, Amazon Cloud Drive, Microsoft OneDrive, Google Drive, Box Sync). Remote cloud search is also possible and can be configured using the console. To search cloud storage data, you must give permission to Spirion by authenticating each provider you would like to search. - **All Removable Drives** - Spirion can also scan USB drives on connection for auto discovery, classification, and remediation actions. - **Custom Folder List** - Scan only the selected folders and files on the Target machine(s) 4. Select one: 5. - Create a new Full Computer - Logged in User's Directory - All Removable Drivers Scan ![](https://cdn-assets.productfruits.com/daa70a34-4eca-469c-961d-628c05f348a7) 6. For this example, select **Full Computer Scan**. #### **Custom Folder List** Procedure: 1. On the **Select which custom folders to add** screen, enter the folders to include or exclude. See "About Using Custom Folders" below. 2. - **Include**: Enter the folder(s) to include, one per line. - **Exclude**: Enter the folder(s) to exclude, one per line. **Note**: You must **include** or **exclude** at least one folder. - **Import Custom Folders**: Upload a .csv file of custom folder types. 3. Click **Import Custom Folders**. Navigate to the .csv folder to import from your computer. 4. In the **Import CSV** window, select: 5. - Include - Exclude - By Flag (includes & excludes) 6. Click **Import** to import the file or **Cancel** to discard. #### About Using Custom Folders In the **Scan Wizard** of Spirion Sensitive Data Platform (SDP) v13.6, the **Include** and **Exclude** fields on the **Add Custom Folders** page are used to define the specific scope of a scan on a target asset. These fields enable you to fine-tune exactly which directories the Spirion Agent will inspect and which it will bypass. **1\. The "Include" Field** - **Purpose:** Defines the starting point or specific directories that the Agent **must** scan. - **Behavior:** If you add a path to the Include list (for example, `C:\Users\Public\Documents`), the Agent will look inside only that specific folder and its subfolders. - **Usage Tip:** Use this when you want to perform a targeted scan on a known "high-risk" directory rather than scanning the entire drive, which saves time and system resources. **2\. The "Exclude" Field** - **Purpose:** Defines specific subdirectories within an included path that the Agent **must skip**. - **Behavior:** If you are scanning `C:\Users` but add `C:\Users\*\AppData` to the Exclude list, the Agent will scan every user's documents and desktop but will ignore the AppData folder. - **Usage Tip:** This is primarily used to avoid "noise" and permission errors. Common exclusions include the following: - - System folders (for example, `C:\Windows`, `C:\Program Files`). - Temporary folders where data is transient. - Backup or Archive folders that have already been scanned. **How They Work Together** The Scan Wizard follows a **"Include First, Then Filter"** logic: 1. The Agent identifies the **Include** path as the boundary. 2. As it traverses that boundary, it checks every folder against the **Exclude** list. 3. If a folder matches an exclusion, the Agent stops and moves to the next available directory. **Best Practices** When using these fields in the Scan Wizard: - **Use Wildcards:** You can use the asterisk (`*`) as a wildcard. For example, `C:\Users\*\Downloads` will exclude the Downloads folder for every user on the machine. - **Avoid Network Mapped Drives:** If you are scanning a remote share, use the **UNC path** (for example, `\\Server\Share\Folder`) in the *Include* field rather than a mapped letter (like `Z:\`), as the Spirion Service Account may not see mapped drives created by a logged-in user. - **Syntax Matters:** Ensure there are **no trailing spaces** in your paths, as this can sometimes cause the Agent to fail to match the directory correctly, leading to the exclusion being ignored. **How are Exclusions Prioritized?** In the Spirion Sensitive Data Platform, exclusions follow a **"Deny Overrides Allow"** logic. This means that if a file or folder matches an exclusion rule, it is skipped immediately, even if it also matches an inclusion rule. The prioritization of exclusions is processed in a specific order by the Agent's search engine: 1\. Global/Policy Exclusions (Highest Priority) - These are the "hard" boundaries set at the Policy level. They are checked before the Agent even attempts to look at a file. - **Path Exclusions:** If a directory is in the "Exclude Paths" list, the Agent will not enter it. - **File Extension Exclusions:** If a file has an excluded extension (e.g., `.exe`, `.dll`), the Agent will not open it. - **Size Exclusions:** If a file exceeds the "Maximum File Size" limit, it is skipped before the search begins. 2\. Target-Specific Exclusions - If you are using the **Scan Wizard** or configuring a specific **Data Asset**, the "Exclude" fields you define there are evaluated next. - These are prioritized *within* the scope of that specific target. - *Example:* If your Policy includes `C:\`, but your Target configuration excludes `C:\Windows`, the Agent will scan the whole drive but skip the Windows folder. 3\. Search History / "Ignore" List - Spirion uses a "Search History" (also known as the Ignore List) to avoid re-scanning files that haven't changed. - If a file's metadata (Path, Size, and Last Modified Date) matches an entry in the Search History and the file was previously marked as "Clean" or "Ignored," the Agent will skip it. - **Note:** This is a performance-based exclusion. If you change your Data Types (e.g., you start looking for a new pattern), the Agent will ignore the Search History and re-scan the files to ensure nothing was missed. 4\. System/Hardcoded Exclusions (Lowest Priority) - The Spirion Agent has built-in logic to protect itself and the operating system. - **Self-Exclusion:** The Agent automatically excludes its own installation directory (`C:\Program Files\Spirion`) and its log/database directory (`C:\ProgramData\Spirion`) to prevent infinite loops or scanning its own results. - **System Locks:** If a file is locked by the System (System Error 32), the Agent is forced to skip it, effectively treating it as a temporary exclusion. * * * **The "Logic Flow" Summary** When the Agent encounters a file, it asks these questions in order: 1. **Is the Path excluded?** (If Yes → Skip) 2. **Is the Extension excluded?** (If Yes → Skip) 3. **Is the File too large?** (If Yes → Skip) 4. **Is this file in my Search History and unchanged?** (If Yes → Skip) 5. **Is the file locked by another process?** (If Yes → Skip/Retry) 6. **Scan the file.** #### What Path Syntax does the Scan Wizard Support? The **Scan Wizard** supports standard Windows and network path syntax, along with specific wildcard patterns for flexible scoping. 1. **Local Path Syntax** - For scanning local drives on an endpoint: 2. 1. **Absolute Paths:** `C:\Users\Public\Documents` 2. **Drive Roots:** `C:\` (Scans the entire C drive) 3. **Subdirectories:** `D:\Data\Finance\2024` 3. **Network Path Syntax (UNC)** - When scanning remote file shares, you should always use **UNC (Universal Naming Convention)** paths rather than mapped drive letters (like `Z:\`), as mapped drives are user-specific and often invisible to the Spirion Service Account. 4. 1. **Standard UNC:** `\\ServerName\ShareName\Folder` 2. **IP-based UNC:** `\\10.1.2.3\ShareName\Folder` 5. **Supported Wildcards** - Spirion supports the asterisk (`*`) as a wildcard to represent one or more characters in a folder or file name. 6. - **Single Level Wildcard:** `C:\Users\*\Documents` - - *Result:* Scans the Documents folder for **every user** on the machine (e.g., `C:\Users\John\Documents`, `C:\Users\Jane\Documents`). - **Partial Name Wildcard:** `C:\Data\Finance_202*` - - *Result:* Scans folders like `Finance_2021`, `Finance_2022`, `Finance_2023`, etc. - **Deep Wildcard (Recursive):** `C:\Data\**\Confidential` - - *Result:* Scans any folder named "Confidential" regardless of how deep it is within the `C:\Data` directory structure. 7. **Important Syntax Rules**: 8. 1. **No Trailing Spaces:** Ensure there are no spaces at the end of your path strings (e.g., `C:\Data` ), as this will cause the Agent to fail to find the directory. 2. **Case Sensitivity:** While Windows paths are generally case-insensitive, it is a best practice to match the casing of the target system to ensure consistent behavior across different Agent types (like Linux or Mac). 3. **Environment Variables:** The Scan Wizard **does not** reliably support Windows environment variables like `%USERPROFILE%` or `%TEMP%`. You should always use the absolute path or the `C:\Users\*` wildcard instead. 4. **Hidden Shares:** You can scan hidden administrative shares by appending a dollar sign: `\\ServerName\C$\Users`. **Recommendations** - When configuring **Exclusions** in the Scan Wizard, use the most specific path possible. - For example, instead of just excluding `*\Temp\*` (which might skip important data in a folder someone accidentally named "Templates"), use `C:\Windows\Temp\*` to ensure you are only skipping the intended system temporary files. **Troubleshooting Tips** - If you have a conflict where you want to scan a specific folder *inside* an excluded area (for example, you exclude `C:\Users\*` but want to scan `C:\Users\Public`), the **Exclusion will win**. - To fix this, you must refine your exclusion syntax. Instead of excluding `C:\Users\*`, individually exclude the specific user folders you don't want, or use a more complex wildcard pattern that does not encompass the `Public` folder. #### Remote Target Remote Targets are used for some sources, but not all. Procedure: 1. After selecting the **Files & Folders** tile, select the **Remote Target** target type. 2. The next screen is the **Select the agent(s) to perform the scan** screen. Select from the **All On-Prem Agents** list. ![](https://cdn-assets.productfruits.com/80908b35-7380-44ac-a167-ff4f8fb67641) 3. Click **Finish & Save** to add the new Scan, **Previous** to return to the previous screen, or **Exit Without Saving** to discard. ![](https://cdn-assets.productfruits.com/006dc207-47cf-4e48-97d9-1bd58f8ebf78) #### Custom Folder List Procedure: 1. Select the **Custom Folder List** location type. The **Select which customer folders to add** screen opens. 2. To include folders, type the name(s) of the folders, one title per line, in the **Include** field. 3. To exclude folders, type the name(s) of the folders, one title per line, in the **Exclude** field. You must include or exclude at least one folder. 4. To import a custom folder list .csv file, click **Import Customer Folders** button in the upper, right of the screen. The **Import CSV** window opens. 5. Select of the following options: 6. - **Include** - **Exclude** - **By Flag (includes & excludes)** 7. The **Select a csv file to import\*** entry field is required. Once your cursor is in this field, a folder on your computer opens. 8. Enter or locate the folder to use. Click Open. Click the **Import** button to import the folder or **Cancel** to discard. 9. You can also click the **Advanced Options** button on this screen. 10. 1. When selected the **Add Custom Folders - Advanced Options** screen opens. 2. The button now says **Basic Options**. 3. To return to the previous screen, click this button again. 4. To continue, select **Next**. #### Add Custom Folders - Advanced Options (Custom Folder List scans only) ![](https://cdn-assets.productfruits.com/2492071f-3983-404f-87d4-cb4df6b95d96) - **Scan Shadow Volumes**: - - **What it does** - The Scan Shadow Volumes setting controls whether the Spirion Agent inspects data stored in Windows Volume Shadow Copies (VSS). - - When this setting is enabled, the Spirion Agent will not only scan the "live" files currently on the drive but will also traverse the Shadow Copies (snapshots) created by the Windows Volume Shadow Copy Service. These snapshots are typically used by Windows System Restore or backup software to keep historical versions of files. - **Why you would use it** - - **Historical Discovery**: Sensitive data that was recently deleted or modified in the "live" file system may still exist in a shadow copy. Enabling this ensures you are finding data that was there but is now hidden in a snapshot. - **Compliance/Forensics**: If you are performing a deep audit or forensic investigation, you may need to prove that sensitive data does not exist in any form on the disk, including historical snapshots. - **Why you might leave it disabled (Default)** - - **Performance Impact**: Scanning shadow volumes can significantly increase the duration of a scan, as the Agent is essentially scanning multiple "versions" of the same drive. - **Duplicate Results**: You may see multiple findings for the same file (one in the live path and one in each shadow copy path), which can clutter your search results and reporting. - **Remediation Limitations**: Spirion cannot remediate (shred, redact, or encrypt) data inside a Shadow Volume because those snapshots are read-only by design. You can only find the data; you cannot fix it through the Spirion interface. - **Recommendations** - - For standard recurring discovery scans, **leave this setting disabled**. It is best reserved for "one-time" deep-dive audits or when you suspect that sensitive data has been moved or deleted to avoid detection but may still reside in a system snapshot. - If you do **enable** it, be prepared for a longer scan time and ensure your Spirion Agent has sufficient CPU and memory resources to handle the additional overhead of mounting and traversing the VSS snapshots. - **Follow Junctions** - - **What it does**: This setting determines how the Spirion Agent handles **NTFS Junction Points** (and symbolic links) during a scan. - - **When Enabled (Checked)**: The Spirion Agent treats a Junction Point like a real folder. It "follows" the link and scans all the files and sub-folders located at the target destination. - **When Disabled (Unchecked)**: The Spirion Agent sees the Junction Point but **will not** enter it. It skips the linked content and moves on to the next "real" folder in the directory. - **What is a Junction Point?** - - In Windows, a Junction Point is a type of symbolic link that points one directory to another - **Example**: \`C:\\MyData\` might actually be a link to \`D:\\RealData\`). - **Why you would use it** - - **Complete Coverage**: If your organization uses Junctions to organize data across different drives or volumes, you must enable this to ensure Spirion finds all sensitive data, regardless of whether it is stored in a "real" folder or a linked one. - **Legacy Support**: Some older applications use Junctions to maintain path compatibility (for example, the \`C:\\Documents and Settings\` junction in newer versions of Windows). - **Why you might leave it disabled (Default)** - - **Preventing Infinite Loops**: If a Junction Point points back to a parent directory (a "circular reference"), the Agent could get stuck in an infinite loop, scanning the same files over and over until it crashes or times out. - **Avoiding Duplicate Scans**: If you are already scanning \`D:\\RealData\` as a separate target, and \`C:\\MyData\` is just a junction pointing to it, enabling "Follow Junctions" causes Spirion Sensitive Data Platform to scan the same data twice, doubling your scan time and duplicating your results. - **System Noise**: Windows uses many internal Junctions for system management (like \`C:\\Users\\All Users\`). Following these can lead to "Access Denied" errors or scanning irrelevant system files. - **Recommendations** - - For most standard endpoint and file share scans, **leave "Follow Junctions" disabled**. - It is safer and more efficient to explicitly include the "real" target paths in your scan scope rather than relying on the Agent to follow links. - If you must enable it, ensure you have robust \*\*Exclusions\*\* in place to prevent the Agent from falling into circular loops or scanning system-managed Junction Points. - **Only Scan Local Drives**: - - **What it does**: The "Only Scan Local Drives" setting is a safety and performance feature that restricts the Agent's reach. - - When this setting is enabled, the Spirion Agent only inspects files on physical drives that are directly attached to the machine (for example, \`C:\`, \`D:\`, or internal SSDs/HDDs). It automatically ignores any drives that are identified by the operating system such as **Network Drives** or **Mapped Shares**. - **Why you would use it** - - **Preventing "Double Scanning"**: If a user has mapped a network share (like \`Z:\\\`) to their local machine, and you are already scanning that same share via a separate "File Share" target, enabling this setting prevents the endpoint Agent from scanning it again. This avoids duplicate results and unnecessary network traffic. - **Performance & Bandwidth**: Scanning a network share over a VPN or a slow office connection can be extremely slow and can saturate the network. This setting ensures the Agent stays "in its lane" and only processes local data. - **Permission Issues**: Endpoint Agents often run as a local system account that may not have the credentials to access a user's mapped network drives, leading to a flood of "Access Denied" errors in your logs. - **Why you might leave it disabled** - - **Intentional Share Scanning**: If you *want* the endpoint Agent to scan a specific mapped drive or a USB-attached network storage device that Windows identifies as non-local, you must disable this setting. - **Non-Standard Storage**: Some specialized storage setups (like certain SAN or iSCSI configurations) might be flagged as non-local by the OS. If you find that Spirion is skipping a drive you know is "local," disabling this setting may resolve the issue. - **Recommendations** - - For **Endpoint Policies** (Windows/Mac laptops and desktops), **always enable "Only Scan Local Drives"**. - This is a best practice to ensure that your endpoint discovery remains focused on local user data and doesn't accidentally trigger massive, slow scans of your corporate file servers through a user's mapped drive. - If you need to scan a file server, do so using a dedicated **File Share Target** and a specific **Discovery Agent** rather than relying on endpoint Agents to find it via mapped drives. - **Skip Offline Files**: - - **What it does**: The Skip Offline Files setting is designed to prevent the Agent from triggering unnecessary data downloads from cloud storage or archival systems. - - When this setting is enabled, the Spirion Agent checks the Windows File Attributes of every file it encounters. - If a file is marked with the FILE\_ATTRIBUTE\_OFFLINE attribute, the Agent skips it and moves on to the next file. - **Why you would use it** - - **Preventing "Hydration" (Cloud Storage)**: Services like OneDrive, Dropbox, or SharePoint often use "Files On-Demand." - - This means the file appears in the folder, but the actual content is stored in the cloud. - If Spirion tries to scan an "offline" file, Windows forces the file to download (hydrate) to the local disk. - Enabling this setting prevents Spirion from accidentally downloading gigabytes of data and filling up the user's hard drive. - **Avoiding Slow Archival Systems**: Some enterprise storage systems (like HSM - Hierarchical Storage Management) move old files to slow tape or cloud archives. - - Accessing these files can take minutes or even hours. - Skipping offline files ensures the scan remains fast and doesn't "wake up" expensive archival systems. - **User Experience**: On an endpoint, a user might see "Downloading..." notifications if Spirion touches their offline OneDrive files. - - Enabling this setting ensures the scan is silent and non-disruptive. - **Why you might leave it disabled** - - **Complete Compliance**: If your goal is to find every piece of sensitive data, regardless of where it is stored, you must disable this setting. However, be aware of the performance and storage implications mentioned above. - **Local-Only Environment**: If you do not use cloud storage or archival systems that use the "offline" attribute, this setting will have no effect on your scan. - **Recommendations** - - For Endpoint Scans (laptops/desktops), always enable "Skip Offline Files". This is critical to prevent Spirion from triggering massive downloads from OneDrive or other cloud providers. - If you need to scan the data that is currently "offline," you should do so by targeting the source directly (for example, using the OneDrive/M365 Connector) rather than scanning it through the local endpoint's file system. - **Allow Invalid File Systems**: - - **What it does**: The Allow Invalid File Systems setting is a technical override that enables the Agent to attempt to scan drives that Windows does not recognize as standard file systems. - - By default, the Spirion Agent only scans drives formatted with standard, recognized file systems like NTFS, FAT32, or exFAT. - If it encounters a drive with a file system it doesn't recognize (often labeled as "RAW" or "Unknown" by Windows), it skips it to avoid errors or system instability. - Enabling this setting forces the Agent to ignore that "invalid" flag and attempt to read the data on that drive anyway. - **Why you would use it** - - **Non-Standard Storage**: You may have specialized storage devices, encrypted volumes, or legacy hardware that uses a proprietary or non-standard file system that Windows can mount but doesn't fully "understand." - **Cross-Platform Drives**: If you have a drive formatted for a different operating system (like a Linux EXT4 drive) that is being presented to a Windows machine via a third-party driver, Windows might flag it as invalid. This setting enables Spirion to attempt to scan it. - **Corrupt File Systems**: In some forensic or recovery scenarios, a drive's file system header might be slightly corrupted, causing Windows to flag it as invalid even though the data is still readable. - **Why you might leave it disabled (Default)** - - **System Stability**: Attempting to read from a truly "invalid" or corrupt file system can cause the Spirion Agent to crash, or in extreme cases, cause the Windows operating system to hang or Blue Screen. - **Garbage Data**: If the file system is truly invalid, the Agent will likely just see "garbage" data (random bits), which leads to a high number of false positive matches and useless search results. - **Performance**: The Agent may spend a long time trying to parse unreadable data, significantly slowing down the overall scan. - **Recommendations** - - Leave this setting **disabled** for all standard production scans: it is a "troubleshooting" or "edge-case" setting that should only be used when you are certain there is readable data on a drive that Spirion is currently skipping due to a file system mismatch. - If you **enable** this setting, **run a test scan** on a single machine first to ensure it doesn't cause any stability issues before deploying the setting to your entire environment. - **Allow Scan for Non-Admin Shares**: - - **What it does**: The Allow Scan for Non-Admin Shares setting controls how the Agent interacts with Windows network shares that are not administrative in nature. - - By default, Spirion Agents often look for Administrative Shares (like C$, D$, or ADMIN$) when scanning remote Windows machines because these shares provide full access to the entire drive for an administrator. - **Enabled** - When "Allow Scan for Non-Admin Shares" is enabled, the Agent is permitted to enumerate and scan Standard (User-Created) Shares - - For example: \\\\Server\\FinanceData or \\\\Server\\Public - **Why you would use it** - - **Targeted Scanning**: If you want to scan only a specific departmental share rather than the entire administrative C$ drive of a server, you must enable this setting to enable the Agent to "see" and enter that non-admin share. - **Restricted Permissions**: In many highly secure environments, Administrative Shares (C$) are disabled for security reasons. \- In these cases, you must create a standard share and enable this setting for Spirion to be able to scan the data at all. - **NAS and Non-Windows Devices**: Many Network Attached Storage (NAS) devices do not support Windows-style administrative shares. \- To scan a share on a Linux-based NAS or a specialized storage appliance, this setting is typically required. - **Why you might leave it disabled** - - **Security Policy**: If your internal security policy dictates that the Spirion Service Account should only use administrative shares for discovery to ensure a consistent and "all-access" audit trail, you would leave this disabled. - **Reducing Noise**: Disabling this prevents the Agent from accidentally scanning every small, temporary share created by users on a file server, keeping the scan focused only on the primary administrative paths. - **Recommendations** - - For most **File Share Scans**, you should enable "Allow Scan for Non-Admin Shares". \- This provides the most flexibility for scanning departmental data and ensures compatibility with NAS devices and environments where C$ shares are restricted. - **Important Note**: Even with this enabled, the Spirion Agent still requires the appropriate **NTFS and Share Permissions** to read the files within those shares. Enabling this setting only allows the Agent to connect to the non-admin share; it does not bypass the underlying security of the file system. - **Skip System Root**: - - **What it does**: The Skip System Root setting is a performance and stability feature that prevents the Agent from scanning the core Windows operating system files. - - **Enabled (checked)** \- When this setting is enabled, the Spirion Agent automatically identifies the **Windows System Root** directory (typically C:\\Windows) and excludes it from the scan. This exclusion applies even if you have included the entire C:\\ drive in your scan scope. - **Why Enable It** - - **Performance**: The Windows directory contains tens of thousands of system files, DLLs, and drivers. Scanning these files is time-consuming and almost never yields sensitive user data (like PII or PCI). Skipping this folder significantly speeds up the scan. - **Reducing False Positives**: System files often contain complex strings of characters that can accidentally trigger RegEx patterns for things like Social Security Numbers or Credit Card Numbers. Skipping the system root reduces the "noise" in your search results. - **Stability**: Some files in the Windows directory are heavily protected or constantly in use by the operating system. Attempting to open or read these files can lead to "Access Denied" errors or, in rare cases, system performance lag. - **Focus on User Data**: Sensitive data is almost always found in user profiles (C:\\Users), application data, or custom data partitions. The C:\\Windows folder is intended for the OS, not for storing documents or spreadsheets. - **Why Disable It** - - **Malware/Forensics**: If you are scanning for indicators of compromise or performing a forensic audit where you suspect sensitive data might have been hidden inside system folders to avoid detection, you would disable (uncheck) this setting. - **Non-Standard Installations**: If you have a legacy application that incorrectly stores data files inside the Windows directory (which is rare but possible in very old software), you may need to scan it. - **Recommendations** - - For **all standard endpoint and server scans**, you should **always enable "Skip System Root"**. There is very little value in scanning the operating system files, and the performance gains from skipping them are substantial. - If you are worried about missing data, remember that Spirion still scans the C:\\Users directory (where user documents live) and any other custom folders you have defined, even when "Skip System Root" is turned on. - **Use Share Paths in Connection**: - - When you enable "Use Share Paths in Connection," you are presented with 3 options that determine how the Agent identifies and connects to the target server. These options are primarily used to handle environments where a server might be known by multiple names (for example, a NetBIOS name, a Fully Qualified Domain Name (FQDN), or a CNAME alias). - **1\. Hostname only** - - The Agent attempts to connect to the share using only the hostname provided in your target list - For example: \\\\Server01\\Share - **Best Use Case**: Use this if your environment has reliable DNS and you are certain that the Agent can resolve the short NetBIOS name of the server. It is the simplest and cleanest option for reporting. - **2\. Hostname then Hostname/Sharename** - 1. This is a "failover" or "discovery" mode. 2. The Agent first tries to connect using just the Hostname. 3. 1. Example: \\\\Server01 4. If that fails or doesn't provide the expected access, it then tries to connect using the specific Hostname and Sharename combination. 5. 1. Example: \\\\Server01\\Finance 6. **Best Use Case**: Use this when you are scanning a server that has complex permissions or where some shares might be hidden. It gives the Agent 2 chances to establish a valid connection before giving up. - **3\. Hostname/Sharename only** - - **What it does**: The Agent will only attempt to connect using the full UNC path provided - - For example, \\\\Server01.domain.com\\Finance - It will not attempt to "browse" the root of the server or try any other name variations. - **Best Use Case**: This is the most restrictive and secure option. - - Use it when: - - You are scanning a NAS device that requires a specific share path to authenticate. - You are scanning across different domains where FQDNs are required. - You want to ensure the Agent only touches one specific share and never attempts to enumerate other shares on that host. - **Troubleshooting Tip** - - If you are seeing "Network Path Not Found" errors in your logs, switching to "Hostname/Sharename only" and using the IP Address or FQDN of the server is often the fastest way to resolve the issue. - **Authenticate Machines During Scan**: - - **What it does**: The Authenticate Machines During Scan setting is a security and connectivity feature used when scanning remote Windows machines. When this setting is enabled, the Spirion Agent will attempt to establish a formal **authenticated session** with each remote machine in your target list before it begins scanning the folders or shares on that machine. - - It uses the credentials you have provided in the Target configuration to perform a "pre-scan" authentication check. If the authentication fails, the Agent will log an error and move to the next machine rather than attempting to scan and failing on every individual file. - **Why Enable It** - - **Efficiency**: If you are scanning 100 remote servers and your service account password has expired, enabling this setting enables the Agent to fail quickly at the machine level. Without it, the Agent might try to connect to every single folder and file, resulting in thousands of "Access Denied" errors and a very long, useless scan. - **Handling "Guest" Access**: Some Windows environments are configured to allow "Guest" or anonymous access to certain shares. Enabling this setting ensures that Spirion uses your **explicitly provided credentials** rather than accidentally falling back to a low-privilege guest session that might miss sensitive data. - **Audit Logging**: Many security systems (like SIEMs) monitor for failed authentication attempts. By authenticating once at the start of the scan, you create a clean audit trail of the Spirion Agent's activity on that server. - **Why Leave it Disabled (Default)** - - **Local Scans**: If you are only scanning the local drive of the machine where the Agent is installed, this setting is unnecessary because the Agent is already running in an authenticated context (usually as the Local System or a Service Account). - **Domain-Joined Environments**: In a well-configured Active Directory environment where the Spirion Agent is running as a Domain Admin or a highly privileged Service Account, Windows often handles the authentication "silently" in the background. In these cases, explicit authentication may not be required. - **Recommendations** - - For **Remote File Share Scans** or **Distributed Scans** targeting multiple Windows servers, **enable "Authenticate Machines During Scan"**. It provides better error reporting and ensures the Agent is always using the correct, high-privilege credentials you intended. - **Important Note**: This setting is specifically for Windows-to-Windows authentication. It does not apply to cloud targets (like M365) or database targets, which use their own specific authentication mechanisms. - **Enable Session Tracking**: - - **What it does**: The Enable Session Tracking setting is a specialized feature used to maintain persistent connections during long-running scans of remote network resources. - **Enabled (checked)** - When this setting is enabled, the Spirion Agent will actively manage and "keep alive" the network session it establishes with a remote server or NAS device. - - Instead of opening and closing a new connection for every folder or file it inspects, the Agent maintains a single, continuous session for the duration of the scan on that specific machine. - It also includes logic to automatically re-establish the session if it is dropped due to a network hiccup or a server-side timeout. - **Why Enable It** - - **Large File Shares**: If you are scanning a massive file share with millions of files, the overhead of constantly authenticating and re-authenticating can significantly slow down the scan. Session tracking keeps the "pipe" open, improving performance. - **Unstable Networks**: In environments with transient network issues (like scanning over a VPN or a satellite link), session tracking helps the Agent recover more gracefully from brief disconnects without failing the entire scan. - **Aggressive Server Timeouts**: Some storage devices are configured to automatically disconnect idle sessions after a very short period (for example, 5 or 10 minutes). Session tracking sends periodic "heartbeats" to the server to prevent these idle timeouts from interrupting the scan. - **Complex Authentication**: If your environment uses multi-factor authentication (MFA) or complex Kerberos tickets that are "expensive" to generate, maintaining a single session is much more efficient than re-authenticating repeatedly. - **Why Leave It Disabled (Default)** - - **Resource Management**: Maintaining an open session consumes a small amount of memory and a "session slot" on the target server. If you are scanning thousands of servers simultaneously from a single Discovery Agent, you could potentially hit session limits on the target devices. - **Security Policy**: Some high-security environments have "Zero Trust" policies that require every connection to be fresh and re-authenticated. In these cases, persistent sessions might be flagged as a security risk by your network monitoring tools. - **Recommendations** - - For **standard endpoint scans**, leave this setting **disabled**. - For **large-scale File Share scans** or scans targeting **remote servers over a WAN/VPN**, you should **enable "Enable Session Tracking"**. - - It provides a much more resilient scanning experience and reduces the likelihood of "Network Path Not Found" or "Session Timeout" errors in your logs. - **Limit Concurrent Remote Scans** - - **What it does**: The Limit Concurrent Remote Scans setting is a resource management feature that controls how many remote machines a single Agent can scan at the same time. - - When you are performing a **Non-Local Scan** (where one Agent is scanning multiple remote servers or workstations), this setting defines the maximum number of simultaneous connections the Agent will maintain. - For example, if you have 100 servers in your target list and you set this limit to **5**, the Agent will start scanning the first 5 servers. As soon as one server finishes, the Agent will pick up the 6th server, and so on, until the entire list is complete. - **Why you would use it** - - **Network Bandwidth Control**: Scanning remote machines requires pulling data across the network to the Agent for analysis. If an Agent tries to scan 50 servers at once, it could easily saturate your network links. Limiting concurrency keeps the network traffic predictable and manageable. - **Agent CPU/Memory Stability**: Every concurrent scan requires a separate thread and a portion of the Agent's memory. Setting a limit prevents the Agent machine from running out of resources and crashing during a large scan. - **Target Server Performance**: If multiple Agents are scanning the same storage array or file server, they can collectively overwhelm the target's I/O. Limiting concurrency helps reduce the "hammering" effect on your production servers. - **Avoiding Security Alerts**: Some Intrusion Detection Systems (IDS) might flag a single machine making 50 simultaneous high-bandwidth connections as a "scanning attack." A lower concurrency limit makes the Spirion Agent's activity look more like normal administrative traffic. - **Why you might leave it disabled (or set it very high)** - - **High-Performance Hardware**: If your Agent is running on a powerful server with 64GB+ of RAM and a 10Gbps network link, you can safely set a higher limit (for example, 20 or 30) to finish the scan much faster. - **Small Target Lists**: If you are only scanning 2 or 3 remote servers, a limit is generally unnecessary. - **Recommendations** - - For most standard environments, a limit of **5 to 10 concurrent scans** per Agent is the "sweet spot" for balancing speed and stability. If you find that your scans are taking too long, don't just increase this number—instead, consider **adding more Search Agents** to the scan. This distributes the workload across multiple physical machines rather than putting all the pressure on a single Agent's CPU and network card. - **Remote Scan Time Out**: - - **What it does** - The Remote Scan Time Out setting is a safety mechanism that prevents an Agent from getting "stuck" on a single unresponsive remote machine. - - This setting defines the maximum amount of time (in minutes) that the Agent will wait for a response from a remote machine before giving up and moving to the next target in the list. If the Agent is scanning a remote server and that server suddenly reboots, loses network connectivity, or becomes so overloaded that it stops responding to file requests, the Agent waits until this timeout is reached. Once the time expires, the Agent logs a "Timeout" error for that specific machine and proceed with the rest of the scan. - **Why Use It** - - **Scan Predictability**: Without a timeout, a single crashed server could cause your entire scan job to hang indefinitely, preventing you from getting results for the other 99 healthy servers in your list. - **Handling "Zombie" Connections**: Sometimes a network connection stays "half-open" where the Agent thinks it's still connected but no data is actually moving. This setting ensures the Agent eventually "cuts the cord" and moves on. - **Resource Management**: Maintaining a connection to a non-responsive machine consumes a thread and memory on the Agent. The timeout ensures these resources are eventually freed up for other work. - **Why Increase the Timeout** - - **Very Large Files**: If you are scanning massive multi-gigabyte files over a slow WAN link, the Agent might legitimately take a long time to receive the data. If the timeout is too short, the Agent might give up on a healthy but slow connection. - **High-Latency Networks**: In environments with high network latency (like satellite or heavily congested links), the initial connection and enumeration can take several minutes. - **Why Decrease the Timeout** - - **Fast Discovery**: If you are scanning thousands of workstations and you only care about the ones that are currently online and responsive, a short timeout (for example, 2 or 5 minutes) enables the scan to finish much faster by quickly skipping offline machines. - **Recommendations** - - The default value is typically **30 minutes**, which is appropriate for most enterprise environments. - **For Server Scans**: Keep the default or increase it if you have very large files or slow storage arrays. - **For Workstation/Laptop Scans**: Consider decreasing it to **5 or 10 minutes** to ensure the scan doesn't get bogged down by machines that are currently offline or asleep. #### Gmail and Exchange/Exchange Online E-mail Service Providers (Email Targets only) This page appears for Email Targets only. Procedure: 1. On the **Scan servers by account list?** screen, upload or enter the accounts you want to include in your scan. 2. You can select actions for the Mailbox Accounts: 3. - **Scan Attachments** - Supported by Gmail, Exchange Online and On-premise. Thi setting controls how the discovery engine handles files embedded within or attached to email messages. - - This setting is critical for modern data governance because sensitive data—such as spreadsheets containing PII or PDFs with financial records—often lives in attachments rather than the email body itself. - When you are creating a new scan or configuring an Email Target (such as Exchange Online/M365 or Gmail): - - **Mailbox Enumeration**: The SDP engine first identifies the mailboxes and individual messages within the scope you have selected. - **Attachment Inspection**: If "Scan Attachments" is enabled, the engine will not only scan the Subject line and Body text of each email but will also "look inside" every attached file. - **Reporting & Metadata**: When a match is found in an attachment, the result in the SDP Console will identify the specific email (Sender, Recipient, Date) and clearly mark that the finding was located within an attachment rather than the message body. - **Scan All Mailboxes** - Supported by Exchange On-premise. a global toggle on the "Select Accounts to Scan" screen that determines the breadth of your email discovery. Depending on whether you check or uncheck this box, the platform changes how it targets the email environment: - - **When "Scan All Mailboxes" is ENABLED (checked)**: - - **Automatic Enumeration:** The platform will automatically discover every mailbox available via the authenticated Target (e.g., every mailbox in your Exchange Online tenant or Exchange On-Prem server). - **Dynamic Scope:** If new mailboxes are added to your email system between scans, they are automatically included in the next run without you needing to update the scan configuration. - **Use Case:** This is typically used for **Global Compliance** or **Baseline Audits** where you need to ensure no stone is left unturned across the entire organization. - **When "Scan All Mailboxes" is DISABLED (unchecked)**: - - **Manual Targeting:** The "Select Accounts" field becomes active, allowing you to input specific email addresses (e.g., [`ceo@company.com`](mailto:ceo@company.com), `hr-records@company.com`). - **Granular Control:** The scan attempts to authenticate and search only the specific accounts you have listed. - **Use Case:** This is ideal for **Targeted Investigations**, searching "High-Risk" users, or performing a pilot scan on a small subset of users. - **Include Dumpster** - Supported by Exchange On-premise. This setting controls whether the search engine inspects the hidden administrative folders of a mailbox. In the context of Microsoft Exchange, the "Dumpster" is technically known as the **Recoverable Items folder**. - - When **"Include Dumpster" is ENABLED (checked)**: 1. - 1. **Extended Scoping:** The scanner doesn't just look at the visible folders (Inbox, Sent Items, Drafts, etc.). it specifically targets the `Recoverable Items` subtree. 2. **Hidden Data Discovery:** This allows the agent to find sensitive data that a user may have "deleted" (moved to the Trash) and then "emptied" from their Trash. These items stay in the "Dumpster" for a set retention period (typically 14 to 30 days by default in M365) before being permanently purged. 3. **Litigation Hold Awareness:** If a mailbox is on **Litigation Hold** or **Discovery Hold**, the "Dumpster" can contain years of data that the user thinks is gone. Enabling this setting ensures that this "hidden" historical data is audited for sensitive information. - The "Dumpster" consists of several sub-folders that Spirion inspects if this setting is on: - - - **Deletions:** Items emptied from the "Deleted Items" folder. - **Versions:** If Copy-on-Write is enabled, this stores the original copy of an item before it was modified. - **Purges:** Items that have been "hard-deleted" but are still within the retention window. - **Key Considerations**: - - **Increased Scan Time:** Enabling "Include Dumpster" can significantly increase the duration of a scan, especially for long-tenured employees or mailboxes with high volume, as the Recoverable Items folder can often be larger than the "live" mailbox itself. - **Compliance vs. Privacy:** From a **Governance** perspective, including the Dumpster is often a requirement for PCI or HIPAA audits to ensure sensitive data isn't "hiding" in deleted folders. However, from a **Privacy** perspective, some organizations choose to exclude it to focus only on data currently in use. - **Permissions:** For this setting to work, the Service Account or App Registration used by Spirion must have the appropriate **Application Permissions** (like `Mail.Read`) that allow access to the full mailbox structure, including administrative folders. - **Include Online Archive** \- Supported by Exchange On-premise. This setting determines whether the discovery engine scans only the user's primary mailbox or also includes their associated **In-Place Archive**. In Microsoft 365, the Online Archive is a secondary mailbox provided to users to manage storage limits. It is separate from the "Live" primary mailbox and is often where older historical data is moved via retention policies. - - When you enable **"Include Online Archive"** on the "Select Accounts to Scan" screen: 1. - - **Dual-Mailbox Discovery:** The SDP engine authenticates to the user's account and identifies both the **Primary Mailbox** and the **Archive Mailbox** (if one exists). - **Extended Search Scope:** The scan iterates through the entire folder structure of the Online Archive (e.g., archived Sent Items, archived Inbox folders from previous years). - **Unified Results:** Findings from the Online Archive are reported in the SDP Console alongside primary mailbox findings. The metadata will typically indicate the specific source path so you can distinguish between "Live" data and "Archived" data. - **Why This Setting is Critical** - - **Historical Risk:** Users often move years of sensitive spreadsheets, PST imports, or old emails into their Online Archive to "clean up" their primary inbox. This archive can often contain a higher density of stale, sensitive data (PII, PCI, PHI) that has been forgotten. - - - **Compliance Coverage:** For audits like **GDPR** or **CCPA**, you must be able to find and manage sensitive data across the entire user identity, not just their active inbox. Excluding the Online Archive can leave a massive "blind spot" in your data inventory. - **Litigation Hold:** If a user is on Litigation Hold, their Online Archive can grow indefinitely. Searching it ensures that discoverable sensitive data is identified before it becomes a liability. - **Key Considerations** - - **Increased Scan Duration:** Enabling this can effectively **double** (or more) the amount of data the Agent has to process per user. Online Archives often contain tens of gigabytes of historical data. - **Throttling & API Limits:** Since SDP uses the Microsoft Graph API for these scans, scanning both primary and archive mailboxes simultaneously for a large number of users can trigger **Microsoft 365 throttling**. - *Tip:* If you are scanning thousands of archives for the first time, consider a staged rollout or using **Scan Configurations** to manage the load. - **Licensing Awareness:** This setting only functions if the user actually has an Online Archive enabled in M365 (e.g., users with E3 or E5 licenses). If a user does not have an archive, the setting is simply ignored for that specific account. - **Search History Performance:** Once the initial "Deep Scan" of the archive is complete, SDP's **Search History** feature will ensure that subsequent scans only process *new* items moved into the archive, making recurring scans much faster. - **Summary** - - **Enabled:** Scans both the active "Primary" mailbox and the "Online Archive" mailbox. Essential for complete data visibility and compliance. - **Disabled:** Scans only the "Live" mailbox. Faster and uses fewer API resources, but misses historical sensitive data stored in the archive. 4. If you select no Mailbox Accounts for a Target then all Exchange Mailbox Accounts are scanned. 5. - For **Scan All Mailboxes** to be checked, requires that no targets have mailboxes assigned. - For **Scan All Mailboxes** to be unchecked, requires that all targets have mailboxes assigned. 6. Click **Next** to proceed, **Previous** to return to the previous screen, or **Exit Without Saving** to discard. #### Select Accounts to Scan Regardless of your email provider, you must select which email user accounts to scan. To add user accounts: 1. Type the user account name in the entry field and click **Enter**. 2. Search for the user account name. 3. To upload multiple accounts, click **Upload Account List**. 4. Locate and select the .csv file with the accounts on your computer. 5. The user accounts are displayed in the Target box. 6. Click **Next** to proceed, **Previous** to return to the previous screen, or **Exit Without Saving** to discard. 7. On the **Select file type scan options** screen, the **Basic Options** display. 8. Additional are available on the **Select advanced options** screen. #### SQL Advanced Options See [Create New Scan Wizard - Select SQL Advanced Options](https://dm0bkdes5q7a2ls.productfruits.help/en/article/scan-wizard-select-sqladvanced-options). #### NoSQL Advanced Options See [Create New Scan Wizard - Select NoSQL Advanced Options](https://dm0bkdes5q7a2ls.productfruits.help/en/article/create-new-scan-wizard-select-nosql-mongodbadvanced-options). #### Search Linked Web Page Content The "Select website options" page appears only when configuring **Website** Targets. 1. Enter values on the **Basic Options** page as described [here](https://dm0bkdes5q7a2ls.productfruits.help/en/article/scan-options#select-website-options). 2. Click the **Advanced Options** button if applicable. 3. On the **Website Options - Advanced Options** screen, enter values, if applicable as described [here](https://dm0bkdes5q7a2ls.productfruits.help/en/article/scan-options#website-options---advanced-options). 4. Click **Next** to proceed, **Previous** to return to the previous screen, or **Exit Without Saving** to discard. ### Summary The "Summary" screen appears. This step applies to all Target types. 1. On the **Summary** screen, select the chevron (>) to open and review your scan settings. 2. Use the edit icon link to jump to a specific screen to edit a setting. 3. Click the **Finish & Save** button to add the new scan, **Previous** button to return to the previous screen, or **Exit Without Saving** button to discard.