Monitoring for insider risk and data loss

Supported editions for this feature: Chrome Enterprise Premium; Enterprise Standard and Enterprise Plus with Chrome Enterprise Core.  Compare your edition

Insider risk monitoring adds to the security dashboard four reports that summarize content transfer activity:

• Users with most content transfer on Chrome
• Domains with most content transfer on Chrome
• Domain types with most content transfer on Chrome
• Sensitive content transfers on Chrome

These reports help you identify unusual activity and risky behavior. They report on activity using Chrome browser on Windows, Mac, Linux and the Chrome operating system. Other platforms are not supported at this time.

Note: The insider monitoring reports do not include activity in Incognito windows. For information about how to prevent users from opening new Incognito windows, read about the Incognito mode setting.

Configure insider risk and data loss monitoring

To enable insider risk and data loss monitoring, click the View details & enable link in the Monitor data leaks and insider risks box on the Admin console home page. Review the details about the security protections involved with insider risk and data loss monitoring, then click the Enable button.

Enabling insider risk and data loss monitoring automatically enables these enhanced Chrome security protections for users:

• Chrome security event logging records user activity in Chrome that may be relevant from a security perspective, such as Content unscanned, Unsafe site visit, or Password reuse
• Chrome data insights scanning and reporting initiates review of uploaded, downloaded, and printed content to check for sensitive data
• Chrome Enterprise connectors perform the data review for up to 50 MB of content
  • Upload content analysis scans uploaded files for sensitive data and malware
  • Download content analysis scans downloaded files for sensitive data and malware
  • Bulk text content analysis scans large blocks of pasted text for sensitive data when a Data Loss Prevention rule is defined
  • Print content analysis scans printed text for sensitive data
  • Real time URL check scans accessed URLs in real time to protect users against dangerous sites, based on the Safe Browsing Protection Level setting
  • Sensitive data analysis can be expanded by creating Data Loss Prevention rules

These protections are enabled for the entire organization, that is, they are enabled at the root organizational level.

You can customize insider risk and data loss monitoring by changing which organizational units it applies to or updating the configuration; for example, you can limit which security events get logged or prevent certain files from being sent for analysis or downloaded.

Chrome security event logging

1. Sign in to your Google Admin console.

   Sign in using your administrator account (does not end in @gmail.com).

2. In the Admin console, go to Menu  DevicesChromeSettings. The User & browser settings page opens by default.

   If you signed up for Chrome Browser Cloud Management, go to Menu  Chrome browserSettings.

3. To apply the setting to everyone, leave the top organizational unit selected. Otherwise, select a child organizational unit.
4. Go to Browser reporting.
5. Next to Event reporting, select Enable event reporting.
6. (Optional) Configure additional settings. Choose the reported event types that you need, based on what type of content you want to send for analysis. For details, see Chrome audit log.
   • Default event types—Chrome threat and data protection events include malware transfer, password reuse, and unsafe site visits.
7. Click Save.

Chrome data insights scanning and reporting

1. Sign in to your Google Admin console.

   Sign in using your administrator account (does not end in @gmail.com).

2. In the Admin console, go to Menu  SecurityAccess and data controlData protection.
3. Under Data protection insights setting, make sure that Data protection insight scanning and report is ON.

If you change the Data protection insight scanning and report to OFF, it pauses production of the new insider risk monitoring reports. When you turn the setting back on, the reports will be available in a day or two.

Chrome Enterprise connectors

For details about configuring how Chrome connectors review content, see Set Chrome Enterprise connector policies for Chrome Enterprise Premium .

Related topics

• Protect Chrome users with Chrome Enterprise Premium
• Use Chrome Enterprise Premium threat and data protection to integrate DLP with Chrome