: View Asset Snippets for Incidents
Focus
Focus

View Asset Snippets for Incidents

Table of Contents

View Asset Snippets for Incidents

Learn how to analyze the content that triggered a match on
Data Security
.
A snippet is evidence or identifiable information associated with a pattern match. For example, if you specified a data pattern of Credit Card Number,
Data Security
returns the user’s social security number as the snippet that was matched. By default,
Data Security
returns snippets if the cloud app and asset type support snippets.
Data Security
uses data masking to mask the data in the snippets.
Snippets are available for 90 days only.
A snippet enables you to investigate the content behind an incident. View a snippet to:
  1. Locate the specific asset.
    • Select
      Data Security
      Data Assets
      Quarantined Data Assets
      to view a list of assets that have been quarantined.
    • Select
      Data Security
      Data Assets
      to select from a list of all assets.
    • Select
      Data Security
      Incidents
      to view a list of incidents.
  2. Choose
    High
    Confidence Level to filter out false positives.
  3. Click
    Request Snippets
    if the snippet is blurry.
    Wait while the service retrieves the data. Initially, the snippet is blurry. After the service verifies that you have the required role priviledges and retrieves the snippet, the SaaS Security web interface displays clear text with highlighted matches. If you recently requested to view the snippet, it displays automatically.
    • Missing button
      —If your cloud app or asset type is not supported, the button does not display in
      Matching Data Patterns
      . Additionally, snippets are not support for machine learning data patterns; instead, the SaaS Security web interface displays the keywords that were flagged because of the machine learning data pattern.
    • Greyed-out button
      —If it’s an asset that is unavailable, the button is disabled.
    • Missing snippet text
      —To intentionally obscure sensitive data, depending on your data masking, some of the text in the snippet might not be in clear text.
    • Performance
      —To speed up on-demand performance, the service fetches the snippet from cache when available; if unavailable, the snippet is automatically downloaded from the cloud app.
    • Mismatch
      —When you compare a snippet to its corresponding download file, it’s possible to overlook a match:
      Data Security
      can match on an embedded text table, or image in the main document. Look closely at all embedded files.
    • Error messages and behaviors
      —When working with snippets, you might encounter the following errors or symptoms, which are not indicative of snippet support: if the
      Request Snippets
      button displays, then
      Data Security
      supports snippets for your cloud app.
    Symptom
    Explanation
    Solution
    When you
    Request Snippets
    in an attempt to view the snippet data, a match that you previously observed no longer displays.
    Such a request triggers a rescan of the asset. If the contents of the asset changed or the data pattern or data profile changed in the underlying policy or both, the match might no longer apply and one or more occurs:
    • The occurrence counter displays an updated number based on the recalculation.
    • The match no longer displays in
      Matching Data Patterns
      .
    • If the match previously generated an incident, that incident is closed.
    No action necessary. This behavior is expected and by design.
    When you
    Request Snippets
    , an error message displays:
    Some snippets are taking longer than expected. Please check back later.
    If a fetch takes longer than 2 minutes, the service returns this error.
    Try again in a few minutes.
    When you download and view the asset, the snippet does not match the document.
    Data Security
    can match on an embedded text table, or image in the main document. This embedded information might not be apparent when you’re looking at the main document.
    No action necessary. This behavior is expected.
    When you
    Request Snippets
    , an error message displays:
    Fetching snippets failed. Please contact support.
    Unfortunately, this error is not easy for you to troubleshoot because there are many system components involved.
    Contact SaaS Security Technical Support.
  4. Analyze the snippet, then make an assessment.

Recommended For You