2.10.5 Collecting logs for suspicious print operations
Cases of an excessive number of print jobs can be treated as suspicious operations and collected in logs. To collect logs for suspicious print operations, you need to set the conditions for determining suspicious operations in a security policy. Suspicious print operations are detected for the computers to which this security policy is assigned. For details about the conditions for determining that the number of print jobs is excessive, see 2.10.6 Conditions for checking for large numbers of print jobs.
If suspicious print operations are detected, you need to investigate the relevant user name, the number of print jobs, and the times the print jobs were submitted to prevent confidential information leakage. When suspicious operations are detected, a Suspicious Operations event is reported. Based on this event, check the collected operation logs to determine whether the large number of print jobs is problematic considering information leakage or costs.