# Prove Forcepoint is working — first tool + proof field

Source: https://ai.techclick.in/blog_forcepoint_evidence_desk
Markdown: https://ai.techclick.in/blog_forcepoint_evidence_desk.md
Publisher: Techclick Infosec Pvt Ltd

How you prove Forcepoint is working: Transaction Viewer, Policy, Action, User/Source IP, DLP incident, NGFW Logs. Five tickets with first tool and one proof field.

Quick answer (say this out loud)

    Transaction Viewer  answers “did this browser request even hit Forcepoint Web — and which  Action  /  Policy ?”  User  and  Source IP  answer “who was on the wire?” (cloud Help:  User  can be  Not available  when authentication is bypassed).  NGFW Logs  answers “did this connection Allow, Discard, or Refuse — and which  Rule Tag ?” A  DLP incident  answers “which policy, action plan, and channel fired?”  Test Filtering  is a predicted URL-filter action, not a logged transaction. An Allowed Web row is not a healthy NGFW hop. A green endpoint icon is not a Transaction Viewer row.

## 1. Why “is it working?” is five questions

 Operators collapse five failures into one sentence. The laptop never reached Content Gateway or the cloud proxy. Policy blocked the category. The NGFW Access rule Discarded the port. The directory user never authenticated, so  User  is blank. DLP Blocked a payroll upload on the Web channel. Those are five first clicks.

 This page is the night-shift desk for  proof . The factory taught the message path. Here you learn the tools you actually open, in order, when someone asks you to prove Forcepoint is working — Web, NGFW, and DLP as the ticket requires.

   Hero · five tiles, one ticket

   Notice: five tiles, not one “Forcepoint dashboard.” You pick the tile that matches the question, then you quote one field.

   Interview line

   If they say “prove Forcepoint is working,” do not say “I opened Security Manager.” Say: “I prove the Web transaction with Transaction Viewer  Action  +  Policy , the identity with  User  /  Source IP , the firewall connection with NGFW Logs  Action  +  Rule Tag , and the data hit with a DLP incident  ID  +  Channel .”

## 2. Mental model — five proof surfaces

 Memorise five named objects before you click. Each surface is allowed to prove one thing. Over-claiming a field is how you ship a bad change at 02:00.

#### 1 · Transaction Viewer

     Cloud / Forcepoint ONE:  Reporting → Report Center → Transaction Viewer . On-prem Web module uses the same Report Center family. Proves one HTTP/HTTPS request:  Action ,  Policy ,  Category ,  User ,  Source IP ,  URL . Does not prove an NGFW Discard or a DLP action plan.

#### 2 · Policy name

     Web attribute  Policy  = the web policy used for filtering. DLP column  Policy  = the policies the content violated. NGFW does not put a friendly policy name on the log — it puts  Rule Tag  ( RULE_ID ). Quote the field the console actually has.

#### 3 · Action

     Cloud Web: Allowed, Authentication Required, Blocked, Confirmed, Quota. On-prem also exposes  Result  (permitted / blocked). NGFW: Allow, Discard, Refuse, Terminate, Wait for further actions, Wait for authentication. DLP: the action plan — Permit, Block, Audit only, Quarantine, Confirm.

#### 4 · User / Source IP

     Web:  User  +  Source IP  (cloud also has  Connection IP ). Official cloud note:  User  can be  Not available  when authentication is bypassed. NGFW:  Src Addr  +  Auth. User . Empty User is data — it is not “Forcepoint is down.”

#### 5 · DLP incident

     On-prem:  Data → Main → Reporting → Data Loss Prevention  → Incidents (last 3 / 7 days). Cloud Web:  Reporting → Report Center → Incident Manager . An incident is a policy violation. An event is any transaction the engine saw. Quote  ID ,  Policy ,  Action ,  Channel ,  Source .

#### Hard words, once

      Filtering Service  = on-prem engine that applies Web policy.  Content Gateway  = explicit proxy.  Log Database  = what Transaction Viewer reads (not Real-Time Monitor).  SMC  = NGFW Security Management Center.  Action plan  = DLP disposition.  Channel  = Email, Web, FTP, Endpoint application, Endpoint printing, Network printing.

   Flow 1 · five surfaces, one question each

       Five Forcepoint proof surfaces and the one question each is allowed to answer

- Write user + destination + UTC first · then pick the surface Is Forcepoint working? five questions, not one Transaction Viewer This URL / SaaS? Action · Policy Category · URL Report Center → TV not an NGFW Discard Policy name Which policy hit? Web Policy DLP Policy NGFW = Rule Tag not Test Filtering Action What did it do? Block / Allow Discard / Refuse DLP action plan Audit only ≠ Block User / Source IP Who was on wire? User · Source IP Auth. User · Src Not available = bypass not “user missing” DLP incident Which data hit? ID · Policy Action · Channel Data → Reporting event ≠ incident Empty Transaction Viewer is data. It usually means the request never landed. Do not invent a category Allow from an empty log. Fix PAC / proxy / endpoint / GRE, then re-query. Read left → right. Each box is allowed one claim. If you cannot name the field, you are not proving — you are guessing. Say this out loud I prove the Web row, then the policy name, then the action, then the user or source IP, then the DLP incident. I do not change a category, an Access rule, or an action plan until I can quote the field that made me do it. ## 3. Decision flow — ticket → first tool Flowchart first. Do not open Policy Management or an NGFW Access policy until a diamond says so. Path · pick the branch before the menu Notice: the diamond is the ticket. The path is the tool. The field comes last. Do not reverse that order. Flow 2 · first-tool diamond Decision diamond from symptom to first Forcepoint proof tool Symptom first · tool second · field third What must we prove? On the wire? or already inside? Laptop / WFH Transaction Viewer row exists? User / IP SaaS blocked Transaction Viewer Action + Policy Whole site dead NGFW Logs Action + Rule Tag Who is this user? User / Source IP Auth method Data blocked DLP incident ID · Policy · Channel Empty Transaction Viewer → stop. There is no Action to chase. Fix PAC / Content Gateway / Endpoint Web / GRE / IPsec. Then re-open Transaction Viewer. Diamond = decision. Do not publish a category Allow from the bottom box. Test Filtering is Toolbox prediction for URL filtering only. It is not a Log Database row. Read the diamond first. A private TCP port never starts in Transaction Viewer. A payroll upload never starts in NGFW Rule Tag . An empty Web log never starts in a new category Allow. ## 4. How to choose — first tool + proof field Print this next to Forcepoint Security Manager / the cloud portal / SMC. If you cannot recite the proof field, you are not ready to change anything. If the ticket says… First tool (official path) Proof field Do not open first Laptop / hotel / “am I even in Forcepoint?” Cloud or Web module: Reporting → Report Center → Transaction Viewer . Filter User or Source IP + last 15 minutes. On-prem live peek: Reporting → Real-Time Monitor . A row exists (or does not). Then User / Source IP + Action + Policy . Cloud: Filtering Source names Endpoint Web, GRE, IPsec, Cloud connection. A new category Allow · Test Filtering as the only close One SaaS / URL blocked or cautioned after a policy change Reporting → Report Center → Transaction Viewer . Enable Detail View → General + Request Details. Action (Allowed / Blocked / Authentication Required / Confirmed / Quota) + Policy + Category + full URL NGFW Access policy · DLP action plan Whole branch internet dead after a firewall / peer change SMC Logs view, Records arrangement. Filter Src Addr / engine + time. Action (Allow / Discard / Refuse) + Rule Tag + Event (New connection / Connection discarded) + Dst Addr A Web category edit “Who is this user?” / User = Not available / wrong policy Transaction Viewer columns User , Source IP , Authentication Method . NGFW: Auth. User + Src Addr . User (or official Not available ) + Source IP + Authentication Method (Basic, NTLM, SSO, Endpoint, None) Invent a person from the IP · a DLP exception Payroll / USB / web upload “DLP blocked us” On-prem: Data → Main → Reporting → Data Loss Prevention → Incidents (last 3 days). Cloud: Reporting → Report Center → Incident Manager . ID + Policy + Action (action plan) + Channel + Source + Severity A Web category Allow · Test Filtering Test Filtering caveat (official) Web Security Toolbox → Test Filtering takes a user or IP plus a URL and returns the site category, the action applied, and the reason. Help states it provides information only for URL filtering . It is a predicted action. It is not a Log Database row, not a DLP incident, and not an NGFW Rule Tag . If Test Filtering says Block and the user still reaches the site, open Transaction Viewer — empty usually means the request never hit Filtering Service. ## 5. Runbook Side A → B → C Side A proves the Web transaction and the identity on the wire. Side B proves the NGFW connection. Side C proves the DLP incident. On a messy Sev-2, do them in this order until a field lights up. ### Side A — Transaction Viewer (Web) #### Open Transaction Viewer, not the policy editor Path: Reporting → Report Center → Transaction Viewer . Official: Using the Transaction Viewer. Filter User or Source IP + the UTC window on the ticket. Add URL / Domain / Cloud App if you already know the destination. On-prem you can peek live on Reporting → Real-Time Monitor , but the close field still lives in the Log Database.

- #### If the grid is empty, stop hunting Action Empty is the off-cloud sentence. Traffic never reached Content Gateway, Endpoint Web, GRE/IPsec, or the cloud connection. Quote “no Transaction Viewer row for this User / Source IP in this window.” Fix forwarding, then reload. Do not publish a category Allow from an empty report.

- #### Read the columns that close a Web ticket Enable Detail View (or double-click the row). General lists user, policy, action, Web category, risk class. Request Details lists full URL, source and destination IP, referrer, request method. Cloud Action values: Allowed, Authentication Required, Blocked, Confirmed, Quota. Quote Action + Policy + Category .

- #### Read User / Source IP before you invent a person Cloud Help: User can show Not available for transactions where authentication has been bypassed. Also quote Authentication Method (Basic, Downstream Authentication, Endpoint, Form-based login, NTLM, Single sign-on, or None) and Filtering Source (Cloud connection, Endpoint Web (Proxy), Endpoint Web (Direct), IPsec, GRE, EasyConnect, …). Source: Web attributes.

     admin.forcepoint.example · Reporting → Report Center → Transaction Viewer

     Training mock · not live

       Reporting / Report Center / Transaction Viewer

### Transaction Viewer

          User  priya@lab.example

          Date range  Last 15 minutes

          Cloud App  Microsoft Exchange Online

          Action  Blocked

           User  URL / App  Category  Action  Policy  Source IP

            priya@lab.example  outlook.office.com  Webmail   Allowed   Corp-Web-Default  203.0.113.41
            priya@lab.example  attachment.outlook.office.com  Webmail   Blocked   Corp-Web-Default  203.0.113.41

        Reset filters  Apply

    Source:  Forcepoint Help — Using the Transaction Viewer; Web attributes ( Action ,  Policy ,  Category ,  User ,  Source IP ). On-prem Report Center uses the same attribute family. Lab identities only. Training mock · not live.

   Toolbox is the simulation, not the close

   On-prem Web module, right pane  Toolbox :  Test Filtering  (user or IP + URL → category, action, reason — URL filtering only),  Check Policy  (which policy is assigned),  URL Access  (who hit this URL in the last two weeks),  Investigate User . Use them to form a hypothesis. Close the ticket from Transaction Viewer or a DLP incident, not from the popup.

### Side B — NGFW Logs (connection)

- #### Open the SMC Logs view, not Web Report Center A discarded TCP port will not appear as a Web Category hit. Official: What the Logs view shows. Use the Records arrangement. Filter from the Query pane by Src Addr , engine, Service, and time. If NAT sits between your Management Client and the Log Server, select the correct Location or you will see no rows.

- #### Read Action, then Rule Tag, then Event Exportable Firewall fields (official): Action = Allow, Discard, Refuse, Terminate, Wait for further actions, Wait for authentication. Rule Tag = rule tag of the rule that triggered the log event ( RULE_ID ). Event = New connection, Connection closed, Connection discarded. Also quote Src Addr , Dst Addr , Service , Situation , and Auth. User when identity is on the rule.

- #### Do not treat Bytes Sent as an allow Bytes Sent / Bytes Rcvd are counted when accounting entries are created — often at close. A Sample of bytes is not Action = Allow on the ticket that just died. Quote the connection Event that flipped.

     smc.lab.example · Logs · Records arrangement

     Training mock · not live

       Logs / Records / Query: Src Addr = 203.0.113.0/24

### Logs view

          Src Addr  203.0.113.41

          Time range  01:50–02:20 UTC

           Event  Action  Rule Tag  Src Addr  Dst Addr  Service

            New connection   Allow   @209.15  203.0.113.41  203.0.113.10  HTTPS
            Connection discarded   Discard   @214.02  203.0.113.41  198.51.100.20  HTTPS

INFO:  Event = Connection discarded  · Action = Discard · Rule Tag = @214.02

Src Addr 203.0.113.41 → Dst Addr 198.51.100.20 · Service HTTPS

 Do not publish a Web category Allow from this row.

    Source:  Forcepoint NGFW Help — What the Logs view shows; Exportable Firewall and Layer 2 Firewall log entry fields ( Action ,  Rule Tag ,  Event ,  Src Addr ,  Dst Addr ,  Service ). Lab addresses are RFC 5737. Training mock · not live.

### Side C — DLP incident (data hit)

- #### Open the incident list, not Transaction Viewer Category On-prem: Forcepoint Security Manager → Data → Main → Reporting → Data Loss Prevention → Recent Reports → Incidents (last 3 days) or Incidents (last 7 days) . Official: Viewing the incident list. Cloud Web: Reporting → Report Center → Incident Manager . A Web Category of Webmail is not a DLP Channel .

- #### Quote ID, Policy, Action, Channel, Source Table properties (official): ID (incident, a policy violation), Event ID (any transaction the engine saw), Policy , Action (from the action plan), Channel (Email, Web, FTP, Endpoint application, Endpoint printing, Network printing), Source , Destination , Severity (High / Medium / Low), Status , Incident Time . Select the row — the preview pane shows the rest.

- #### Read the action plan, not the Slack verb Possible actions (official): Permit, Block, Audit only, Quarantine, Confirm, Encrypt, Drop attachments, and channel-specific variants. Audit only permits the activity and logs an incident. If Slack said “DLP blocked us” and Action is Audit only, the product did not block. Confirm is a user prompt, not a silent Block.

     fsm.lab.example · Data → Main → Reporting → Data Loss Prevention

     Training mock · not live

       Data / Main / Reporting / Data Loss Prevention / Incidents (last 3 days)

### Incidents (last 3 days)

          Source  priya@lab.example

          Channel  Web

           ID  Incident Time  Policy  Action  Channel  Severity  Status

            884102  01:12 UTC  PII-Web-Monitor   Audit only   Web  Low  New
            884188  02:06 UTC  Payroll-Web-Block   Block   Web  High  New

Incident  884188  · Policy = Payroll-Web-Block · Action = Block · Channel = Web

Source = priya@lab.example · Destination = https://drive.lab.example/upload

Event ID ≠ Incident ID — quote the incident.

    Source:  Forcepoint DLP Help — Viewing the incident list; Table Properties tab ( ID ,  Policy ,  Action ,  Channel ,  Source ,  Severity ); Possible actions for an action plan. Lab identities only. Training mock · not live.

  Ticket paste — fields you write before you change anything  UTC window:      01:50–02:20
Web path:        Reporting → Report Center → Transaction Viewer
Web quote:       Action + Policy + Category + User / Source IP + URL
NGFW path:       SMC Logs → Records
NGFW quote:      Action + Rule Tag + Event + Src Addr + Dst Addr
DLP path:        Data → Main → Reporting → Data Loss Prevention
                 (cloud: Reporting → Report Center → Incident Manager)
DLP quote:       ID + Policy + Action + Channel + Source + Severity
If Web empty:    forwarding — not a category Allow

   Green success on each side

- Side A wire: Transaction Viewer has a row for that User / Source IP in the window. Side A policy: the same row names Action + Policy .

- Side B: Logs Event + Action + Rule Tag match the minute the site recovered.

- Side C: incident ID names Policy + Action + Channel . Re-test produces either no new incident or a different action plan — not a second silent Block.

## 6. Five tickets as full stories

 These five land every quarter. Memorise first tool + proof field. Times and identities below are lab-only.

   Proof · named field, then Closed

   Notice: the close is a named column on a timestamp — Transaction Viewer Action, NGFW Rule Tag, or DLP incident ID — not a screenshot of the user’s Salesforce tab.

     Ticket  Symptom  First tool  Proof field

       FEVD-01   WFH laptop: “internet is broken, Forcepoint is down”  Transaction Viewer  Row exists? Then  User  /  Source IP  +  Action  +  Policy
       FEVD-02   After a new Web policy, Outlook Web loads, attachments fail  Transaction Viewer Detail View   Action  = Blocked ·  Policy  +  Category  on the attachment URL
       FEVD-03   Branch internet dead since a 02:00 firewall change; Web empty  NGFW Logs   Action  +  Rule Tag  +  Event  = Connection discarded
       FEVD-04   Same IP,  User  = Not available, “wrong policy”  Transaction Viewer identity columns   User  (official Not available) +  Source IP  +  Authentication Method
       FEVD-05   Payroll file upload “DLP blocked us”  DLP Incidents / Incident Manager   ID  +  Policy  +  Action  +  Channel

### FEVD-01 — Prove the Web row (Transaction Viewer)

  01:42 · P2.  Priya on a hotel network. Endpoint icon looks green-ish on a phone photo. L1 already drafted a new category Allow.

  First tool:   Reporting → Report Center → Transaction Viewer . Filter  User  =  priya@lab.example  or  Source IP  = her current address, last 15 minutes.

  If empty:  quote “no Transaction Viewer row for this User / Source IP in this window.” She is not going through Filtering Service or the cloud proxy. Next check is forwarding — PAC returning DIRECT, Endpoint Web down, missing GRE/IPsec, or a bypassed location — not Policy Management.

  If a row exists:  you are allowed to read  Action  +  Policy . Cloud: also quote  Filtering Source  so you know whether Endpoint Web, GRE, or a Cloud connection carried her. The row is not a DLP incident.

  Trap

 Do not close FEVD-01 with Test Filtering. That popup is a predicted URL-filter action. It does not prove her browser hit Forcepoint. Real-Time Monitor is a live peek on-prem — still close from the Log Database row.

### FEVD-02 — Prove the SaaS transaction (Action + Policy)

  02:05 · P2.  Outlook on the Web opens. Attachments fail after last night’s policy ship. Someone wants “another Allow for outlook.office.com.”

  First tool:  Transaction Viewer. Filter User + Cloud App / URL + last hour. Enable Detail View.

  Proof field:  page host  Action  = Allowed; attachment host  Action  = Blocked and  Policy  = the policy you shipped (plus  Category ). That name is the ticket. Change that one policy — or the classifier that fed it — then re-read the same two columns. General tab also lists risk class; when it is Security, Threat Details appears.

  Close

 I would not add a second category Allow. I would quote  Action  +  Policy  on the attachment transaction. A saved policy is not proof until the same filter returns Allowed (or the action you intended).

### FEVD-03 — Prove the NGFW connection (Logs)

  02:20 · P1.  Pune branch: every desk lost internet after a 02:00 firewall change. Transaction Viewer for that Source IP range is empty. L1 wants a Web policy republish.

  First tool:  SMC  Logs  → Records. Filter  Src Addr  for the branch + 01:50–02:20 UTC. Look at  Event  = Connection discarded, not just bytes.

  Proof field:   Action  = Discard (or Refuse),  Rule Tag  of the Access rule that flipped,  Dst Addr  of the VIP or service you think you still allow. Simultaneous 02:00 death is almost never “everyone’s Web cookie expired together.” Empty Web is the clue the packet never reached Filtering Service.

  Close

 Quote Logs  Event  +  Action  +  Rule Tag . Restore the Access rule or the NAT that used to carry 443, then wait for  Action  = Allow and the first Transaction Viewer row. Do not publish a Cloud App exception on an empty Web log.

### FEVD-04 — Prove identity (User / Source IP)

  02:40 · P2.  Same laptop as FEVD-01, now on-cloud. Transaction Viewer shows  User  =  Not available . L1 wants to rebuild the directory connector.

  First tool:  the same Transaction Viewer row. Add columns  User ,  Source IP ,  Authentication Method ,  Filtering Source . Official cloud attribute:  User  can be Not available when authentication has been bypassed.

  Proof field:   Authentication Method  = None (or a method you did not expect) +  Source IP  +  Policy  that actually applied (often the default / unauthenticated policy). That is why the category action looks “wrong.” Rebuild directory only after you prove the request never presented NTLM, SSO, or Endpoint credentials.

  Trap

 Do not invent a display name from DHCP. Quote the official Not available value. NGFW  Auth. User  is a different store — only if the Access rule used user identity.

### FEVD-05 — Prove the DLP incident

  03:00 · P2.  Finance: “DLP blocked the payroll upload to the vendor portal.” Someone typed Sev-1 and drafted a Web category Allow.

  First tool:   Data → Main → Reporting → Data Loss Prevention  → Incidents (last 3 days). Filter Source + Channel = Web. Cloud tenants: Incident Manager, Detail View tabs Matches / Source & Destination / Properties.

  Proof field:  incident  ID  +  Policy  +  Action  +  Channel  +  Severity . If  Action  is Audit only, the product permitted the upload and logged it — that is not a Block. If  Action  is Confirm, the user dismissed the prompt. A category Allow will not change an action plan.

  Close

 I would leave Web categories alone. I would paste incident  ID ,  Policy ,  Action , and  Channel . Change-control is a scoped exception or a Severity & Action edit on that one rule — with an owner — not a night-shift Block All → Permit flip.

## 7. Traps + close-the-ticket proof

     You see  Weak close  Strong close

      Empty Transaction Viewer  “Forcepoint is down” / new category Allow  Quote no row for this User / Source IP; fix forwarding; reload Transaction Viewer
      Row exists, still failing  “Forcepoint is fine”  You only proved the wire. Read  Action  +  Policy  on that URL.
      Action = Allowed  “Forcepoint is working”  Allowed is a Web verdict, not an NGFW Allow and not a DLP Permit. If they said data leak → incident list. If they said site-down → Logs.
      Test Filtering says Block  Trust the popup and republish  Official: URL filtering only. Confirm with a Transaction Viewer row.
      User = Not available  Rebuild directory / “user missing”  Official bypass wording. Quote  Authentication Method  +  Source IP  + the policy that applied.
      NGFW Bytes Sent > 0  “Tunnel / rule is fine”  Read  Event  +  Action  +  Rule Tag . Bytes are accounting at close.
      DLP Action = Audit only  “DLP blocked us”  Audit only permits and logs. Quote the action plan name.
      Traffic log has events, no incident  “DLP is broken”  An event is any transaction. An incident is a policy violation. Check threshold / action plan / off-box component (official DLP topic).
      SMC Logs empty  Forcepoint NGFW is down  Wrong Location when NAT sits in front of the Log Server. Select Location, then re-query.

   Proof checklist before you leave the bridge

- UTC window written next to the tool you opened.

- Web row proved (or officially empty) for the failing User / Source IP when the ticket is “is Forcepoint even working?”

- One transaction quoted: Web Action + Policy , or NGFW Action + Rule Tag , or DLP incident ID + Channel .

- Identity quoted when policy looks “wrong”: User or official Not available + Authentication Method .

- Next tool named — or change-control owner named. No policy publish without residual control.

- Test Filtering never used as the only close. Real-Time Monitor never used as the only close.

   Interview close

   I name the question, then the first tool, then one official field. Transaction Viewer proves the Web request.  Policy  and  Action  prove the verdict.  User  /  Source IP  prove who was on the wire. NGFW Logs prove the connection. A DLP incident proves the data hit. I do not change a category, an Access rule, or an action plan until that field is on the ticket. Factory model:  session factory .

## Knowledge check

   Six night-shift judgments. Each maps to a first tool or a proof field. Check answers, then Reset if you picked the wrong surface.

       Q1
       WFH user: “Is Forcepoint even working?” You have not opened Policy Management yet. First proof?

           Add a category Allow for the site they named
           Open Reporting → Report Center → Transaction Viewer for their User or Source IP — quote whether a row exists, then Action + Policy
           Open DLP Incident Manager for Salesforce
           Disable SSL decryption for the tenant

       Correct:  b . Official Transaction Viewer path. Empty means there is no Action to hunt. Re-read Side A steps 1–2 and FEVD-01.

       Q2
       A new Web policy shipped an hour ago. Outlook Web opens; attachments fail. Which proof field closes FEVD-02?

           Transaction Viewer: Action + Policy + Category on the attachment URL
           NGFW Rule Tag only
           Test Filtering popup — it is faster than logs
           Discovery incident file path

       Correct:  a . Official Web attributes and Detail View General / Request Details. Test Filtering is URL-filter prediction only. Re-read Side A step 3 and FEVD-02.

       Q3
       Pune branch lost internet at 02:00 after a firewall change. Transaction Viewer for that Source IP range is empty. First tool + field?

           Republish the Web policy — cookies must have expired together
           Real-Time Monitor only — live charts explain a dark site
           NGFW Logs (Records) — Action + Rule Tag + Event (Connection discarded)
           Transaction Viewer Category — a Cloud App rule blocked the internet

       Correct:  c . Empty Web is the clue the packet never reached Filtering Service. Official NGFW fields are Action, Rule Tag, Event. Re-read Side B and FEVD-03.

       Q4
       Transaction Viewer shows User = Not available for an on-cloud laptop. What is that value allowed to mean?

           The directory object was deleted — rebuild the connector immediately
           Authentication was bypassed — quote Authentication Method + Source IP + the Policy that applied; do not invent a person
           DLP hid the user name
           NGFW Refuse always blanks User in Transaction Viewer

       Correct:  b . Official cloud Web attribute note. Re-read Side A step 4 and FEVD-04.

       Q5
       Finance says DLP blocked a payroll upload to a vendor portal. First tool + proof?

           Transaction Viewer Category = Webmail
           Test Filtering on the vendor URL
           NGFW Bytes Sent
           Data → Main → Reporting → Data Loss Prevention (or Incident Manager): ID + Policy + Action + Channel

       Correct:  d . Official incident list / Incident Manager. Audit only is not Block. A category Allow will not change an action plan. Re-read Side C and FEVD-05.

       Q6
       Test Filtering says Block. The user still reaches the site. What is the popup allowed to mean?

           It is a predicted URL-filter action, not a logged transaction — open Transaction Viewer; if empty, traffic never hit Filtering Service
           Forcepoint is down — fail over the NGFW cluster
           Always trust Test Filtering over the Log Database
           DLP Confirm fired, so Web Action is irrelevant

       Correct:  a . Official Test Filtering note: URL filtering only. Re-read the caveat in §4, Flow 2 bottom box, and FEVD-01.

       Check answers
       Reset

## Sources

- Forcepoint Help — Using the Transaction Viewer (Reporting → Report Center → Transaction Viewer; Detail View tabs)

- Forcepoint Help — Web attributes ( Action , Policy , Category , User / Not available, Source IP , Authentication Method , Filtering Source )

- Forcepoint Help — What are attributes? (Web Security on-prem) (Report Center / Transaction Viewer attribute family; Result , Full URL )

- Forcepoint Help — Transaction Viewer display options (Detail View: General, Request Details, Cloud Apps, Threat Details)

- Forcepoint Help — Test Filtering (Toolbox; URL filtering only; category, action, reason)

- Forcepoint Help — Real-Time Monitor in multiple Policy Server deployments (Web module → Reporting → Real-Time Monitor)

- Forcepoint NGFW Help — What the Logs view shows (Records / Statistics / Details / Log Analysis; Location when NAT is in front of the Log Server)

- Forcepoint NGFW Help — Exportable Firewall and Layer 2 Firewall log entry fields ( Action , Rule Tag , Event , Src Addr , Dst Addr , Auth. User )

- Forcepoint DLP Help — Viewing the incident list (Data → Main → Reporting → Data Loss Prevention)

- Forcepoint DLP Help — Viewing Incidents and Reports

- Forcepoint DLP Help — Table Properties tab ( ID , Policy , Action , Channel , Source , Severity , Event vs incident)

- Forcepoint DLP Help — Properties (incident number, Severity, Status, Action, Channel)

- Forcepoint DLP Help — Possible actions for an action plan (Permit, Block, Audit only, Quarantine, Confirm)

- Forcepoint Help — Using the Incident Manager (Reporting → Report Center → Incident Manager; Matches / Source & Destination / Properties)

 Related:  Blog 1 · Forcepoint session factory  ·  Forcepoint DLP channels  ·  Forcepoint DLP Endpoint  ·  Forcepoint DLP fingerprinting  ·  All lessons

---
Cite this Techclick lesson with the source URL. Do not invent fees, batch dates, or job guarantees.
Browse all lessons: https://ai.techclick.in/blogs
AI index: https://ai.techclick.in/llms.txt