Listing contents of folder counts as READ for all files
Alex -
When capturing events and reporting on READ the behavior is normal if the Windows Explorer does a preview like thumbnails in the GUI. As example if the Windows Explorer in the GUI form is opened on a folder then the contents of the folder are all read to populate the GUI with the thumbnail, file name, and date information. This is due to the Operating System and is only captured by the application.
If the Administrator only requires the events related to certain types of audit trails be available during the policy it could be create, modify or write to avoid the read.
The Workspace Data Owner Policy may also be configured to use a count that is dependent on READ with either which can affect the effective owner if there is an application like backup that runs on the storage against the file system hosting the share being monitored. By default, Data Insight infers owners of files or folders based on the access history. The most active user of a file is considered to be the data owner for the purpose of efficient remediation and data management.
You have not identified the device you are monitoring but he likelihood that it is a Windows NAS device or a CIFS share on NetApp or Celerra which are affected by the Windows Operating System behavior leave you with a few other choices. You can define a global policy to infer the owners of files or folders based on one of the following criteria:
-
The number of read events on the file or folder.
-
The number of write events on the file or folder.
-
The cumulative count of read and write events on the file or folder
-
The creator of the file or folder.
-
The user account which last accessed the file or folder.
-
The user account which last modified the file or folder.
Let me know if that helps you see why this is happening to your audit events.
Rod
-
