Supported Content, Remediation and Monitoring
Table of Contents
Expand all | Collapse all
-
-
- What’s Data Security?
- Navigate To Data Security in Cloud Management Console
- Activate Data Security on the Hub
- Access Data Security for Standalone SaaS Security
-
- Allowed List of IP Addresses
-
- Begin Scanning an Amazon Web Services App
- Begin Scanning a Bitbucket Cloud App
- Begin Scanning a Box App
- Begin Scanning a Cisco Webex Teams App
- Begin Scanning a Citrix ShareFile App
- Begin Scanning a Confluence App
- Begin Scanning a Confluence Data Center App
- Begin Scanning a Dropbox App
- Begin Scanning a GitHub App
- Begin Scanning a GitHub V2 App
- Begin Scanning a Gmail App
- Begin Scanning a Google Cloud Storage App
- Begin Scanning a Google Drive App
- Begin Scanning a Jira Cloud App
- Begin Scanning a Jira Data Center App
- Begin Scanning a Microsoft Azure Storage App
- Begin Scanning a Microsoft Exchange App
- Begin Scanning Microsoft Office 365 Apps
- Begin Scanning a Microsoft Teams App
- Begin Scanning a Salesforce App
- Begin Scanning a ServiceNow App
- Begin Scanning a Slack for Enterprise Grid App
- Begin Scanning a Slack Enterprise App
- Begin Scanning a Slack for Pro and Business App
- Begin Scanning a Workday App (Beta)
- Begin Scanning a Yammer App
- Begin Scanning a Zendesk App
- Begin Scanning a Zoom App
- Reauthenticate to a Cloud App
- Verify Permissions on Cloud Apps
- Start Scanning a Cloud App
- Stop Scanning a Cloud App
- Rescan a Managed Cloud App
- Delete Cloud Apps Managed by Data Security
- API Throttling
- Configure Classification Labels
-
-
-
- SaaS Security with Enterprise DLP
- Predefined Data Patterns on Data Security
- Proximity Keywords
- Confidence Levels
- Shared Data Profiles and Data Patterns
- Modify a Predefined Data Pattern
- Create a Custom Data Profile
- Add a File Property Data Pattern
- Create a Custom Data Pattern
- Use Exact Data Matching (EDM)
- Enable or Disable a Machine Learning Data Pattern
- Configure WildFire Analysis
- Configure Regular Expressions
- Enable or Disable a Data Pattern
- View and Filter Data Pattern Match Results
-
-
-
- What is an Incident?
- Assess New Incidents on Data Security
- View Asset Details
- Filter Incidents
- Security Controls Incident Details
- Track Down Threats with WildFire Report
- Track Down Threats with AutoFocus
- Customize the Incident Categories
- Close Incidents
- Download Assets for Incidents
- View Asset Snippets for Incidents
- Analyze Inherited Exposure
- Email Asset Owners
- Modify Incident Status
-
- What is a Data Violation?
- Assess New Data Violations on Data Security
- Configure Data Violation Alerts on Data Security
- Filter Data Violations on Data Security
- View Asset Snippets for Data Violations on Data Security
- View Data Violation Metrics on Data Security
- Modify Data Violation Status on Data Security
-
-
-
-
- What’s SaaS Security Inline?
- Navigate To SaaS Security Inline
- SaaS Visibility for NGFW
- SaaS Visibility and Controls for NGFW
- SaaS Visibility for Prisma Access
- SaaS Visibility and Controls for Panorama Managed Prisma Access
- SaaS Visibility and Controls for Cloud Managed Prisma Access
- Activate SaaS Security Inline for NGFW
- Activate SaaS Security Inline for VM-Series Firewalls with Software NGFW Credits
- Activate SaaS Security Inline for Prisma Access
- Connect SaaS Security Inline and Cortex Data Lake
- Integrate with Azure Active Directory
-
-
- SaaS Policy Rule Recommendations
- App-ID Cloud Engine
- Guidelines for SaaS Policy Rule Recommendations
- Predefined SaaS Policy Rule Recommendations
- Apply Predefined SaaS Policy Rule Recommendations
- Create SaaS Policy Rule Recommendations
- Delete SaaS Policy Rule Recommendations
- Enable SaaS Policy Rule Recommendations
- Modify Active SaaS Policy Rule Recommendations
- Monitor SaaS Policy Rule Recommendations
-
- Enable Automatic Updates for SaaS Policy Rule Recommendations on Cloud Managed Prisma Access
- Import New SaaS Policy Rule Recommendations on Cloud Managed Prisma Access
- Update Imported SaaS Policy Rule Recommendations on Cloud Managed Prisma Access
- Remove Deleted SaaS Policy Rule Recommendations on Cloud Managed Prisma Access
- Manage Enforcement of Rule Recommendations on NGFW
- Manage Enforcement of Rule Recommendations on Panorama Managed Prisma Access
- Change Risk Score for Discovered SaaS Apps
-
-
-
-
- Onboarding Overview for Supported SaaS Apps
- Onboard an Aha.io App to SSPM
- Onboard an Alteryx Designer Cloud App to SSPM
- Onboard an Aptible App to SSPM
- Onboard an ArcGIS App to SSPM
- Onboard an Articulate Global App to SSPM
- Onboard an Atlassian App to SSPM
- Onboard a BambooHR App to SSPM
- Onboard a Basecamp App to SSPM
- Onboard a Bitbucket App to SSPM
- Onboard a BlueJeans App to SSPM
- Onboard a Box App to SSPM
- Onboard a Bright Security App to SSPM
- Onboard a Celonis App to SSPM
- Onboard a Cisco Meraki App to SSPM
- Onboard a ClickUp App to SSPM
- Onboard a Confluence App to SSPM
- Onboard a Contentful App to SSPM
- Onboard a Convo App to SSPM
- Onboard a Couchbase App to SSPM
- Onboard a Coveo App to SSPM
- Onboard a Crowdin Enterprise App to SSPM
- Onboard a Customer.io App to SSPM
- Onboard a Databricks App to SSPM
- Onboard a Datadog App to SSPM
- Onboard a DocHub App to SSPM
- Onboard a DocuSign App to SSPM
- Onboard a Dropbox Business App to SSPM
- Onboard an Envoy App to SSPM
- Onboard an Expiration Reminder App to SSPM
- Onboard a Gainsight PX App to SSPM
- Onboard a GitHub Enterprise App to SSPM
- Onboard a GitLab App to SSPM
- Onboard a Google Analytics App to SSPM
- Onboard a Google Workspace App to SSPM
- Onboard a GoTo Meeting App to SSPM
- Onboard a Grammarly App to SSPM
- Onboard a Harness App to SSPM
- Onboard a Hellonext App to SSPM
- Onboard an IDrive App to SSPM
- Onboard an Intercom App to SSPM
- Onboard a Jira App to SSPM
- Onboard a Kanbanize App to SSPM
- Onboard a Kanban Tool App to SSPM
- Onboard a Kustomer App to SSPM
- Onboard a Lokalise App to SSPM
- Onboard a Microsoft Azure AD App to SSPM
- Onboard a Microsoft Exchange App to SSPM
- Onboard a Microsoft OneDrive App to SSPM
- Onboard a Microsoft Outlook App to SSPM
- Onboard a Microsoft Power BI App to SSPM
- Onboard a Microsoft SharePoint App to SSPM
- Onboard a Microsoft Teams App to SSPM
- Onboard a Miro App to SSPM
- Onboard a monday.com App to SSPM
- Onboard a MongoDB Atlas App to SSPM
- Onboard a MuleSoft App to SSPM
- Onboard a Mural App to SSPM
- Onboard an Office 365 App to SSPM
- Onboard Office 365 Productivity Apps to SSPM
- Onboard an Okta App to SSPM
- Onboard a PagerDuty App to SSPM
- Onboard a RingCentral App to SSPM
- Onboard a Salesforce App to SSPM
- Onboard an SAP Ariba App to SSPM
- Onboard a ServiceNow App to SSPM
- Onboard a Slack Enterprise App to SSPM
- Onboard a Snowflake App to SSPM
- Onboard a SparkPost App to SSPM
- Onboard a Tableau Cloud App to SSPM
- Onboard a Webex App to SSPM
- Onboard a Workday App to SSPM
- Onboard a Wrike App to SSPM
- Onboard a YouTrack App to SSPM
- Onboard a Zendesk App to SSPM
- Onboard a Zoom App to SSPM
- Onboarding an App Using Azure AD Credentials
- Onboarding an App Using Okta Credentials
- Delete SaaS Apps Managed by SSPM
Supported Content, Remediation and Monitoring
View the list of supported SaaS applications and their supported remediation options on
Data Security
.Before you add a cloud app to
Data Security
, learn about the scan, remediation, and monitoring features that Data Security
supports for
your cloud app. Usually when a remediation capability isn't supported, it’s due to the
cloud app’s API. However, as a cloud app’s API changes often Data Security
is
able to expand support. Unless otherwise stated, forward scan includes new assets,
deleted assets, and updated content on assets. Additionally, sometimes a feature isn't
relevant to a cloud app’s paradigm (for example, the cloud app doesn’t have
folders), and so the feature isn’t applicable.Content Support on Data Security
Data Security
Scan content support is different from remediation support.
Data Security
can scan content based on supported file types and supported languages, but
within that remediation depends on the cloud app. Additionally, Data Security
offers different types of scan methods based on the type of cloud app and not all
exposure levels apply to some cloud apps. Additionally, unless otherwise stated,
Forward Scan typically includes new assets, deleted assets, and content updates on
assets.Amazon S3 | Buckets, Files | Yes | Yes | Multi-account | Internal, External,Public | — |
Amazon Web Services (AWS) Console | AWS settings | No | Yes | No | n/a | Data Security has deprecated support for the Amazon Web Services app. To continue
monitoring your resources deployed on AWS, try Prisma Cloud. |
Bitbucket | Commit files, Repository | Yes | Yes | n/a | Internal, Public | By default, the backward scan limit is set to 1 year. If you wish
to extend this limit to more than 1 year, contact SaaS Security
Technical Support. |
Box | Files, Folders | Yes | Yes | Yes | All | — |
Cisco Webex Teams | Rooms, Messages, Files | Yes | Yes | No | Internal, External, Public | — |
Citrix ShareFile | Files, Folders | Yes | Yes | No | All | — |
Confluence | Page content, Attachments, Comments | Yes | Yes | No | Internal, External,Public | — |
Confluence Data Center | Page content, Attachments, Comments | Yes | Yes | No | Internal, External, Company | By default, the backward scan limit is set to 1 year. If you wish
to extend this limit to more than 1 year, contact SaaS Security
Technical Support. |
Dropbox - Individual Folder | Files, Folders | Yes | Yes | No | All | — |
Dropbox - Team Folder | Files, Folders | Yes | Yes | No | All | — |
GitHub V2 | Files, Folders | Yes | Yes | No | Internal, Public | Backward scanning is supported up to 1 year only. |
Google Cloud Platform (GCP) | Projects, Buckets, Files | Yes | Yes | Yes | Internal, External,Public | — |
Google Drive - My Drive | Files, Folders | Yes | Yes | Yes | All | |
Google Drive - Shared Drives | Files, Folders | Yes | Yes | Yes | All | |
Jira Data Center | Issue Descriptions, Comments, Attachments, Projects | No | Yes | n/a | No | |
Jira Cloud | Issue Descriptions, Comments, Attachments, Projects | Yes | Yes | n/a | No | By default, the backward scan limit is set to 1 year. If you wish
to extend this limit to more than 1 year, contact SaaS Security
Technical Support. |
Jive | Questions, Discussions, Document, Ideas, Blogs, Files, Comments | Yes | Yes | No | All | — |
Microsoft Azure | Storage Accounts, Containers, Files | Yes | Yes | Yes | Internal, External,Public | — |
Microsoft Exchange | Email content, Attachments | No | Yes | No | Internal, External | — |
Microsoft Office 365 - OneDrive | Files, Folders | Yes | Yes | Yes | All | — |
Microsoft Office 365 - SharePoint | Files, Folders | Yes | Yes | No | All | — |
Microsoft Teams | Channel Messages, Direct Chats | No | Yes | n/a | Internal, External,Company | Attachments are supported using Office 365. Due to new Microsoft licensing
requirements, Microsoft Teams connector will work only for
customers running the E5 licenses. |
Salesforce | Files, Tables, Chatter body | Yes | Yes | No | All | Backward or Forward scan: the service performs Backward scan until it reaches current time, then
performs Forward scan. Content: While Data Security stores the metadata for all unstructured files, it stores
structured file data selectively. For example, a Salesforce
Chatter message has structured data and is stored only when the
content in the message matches a defined data pattern
but an attachment on Salesforce Chatter has unstructured
data, so Data Security scans the attachment and stores
the metadata. |
Secure Data Space | Yes | Yes | Yes | No | All | — |
ServiceNow | Tables, Attachments | Yes | Yes | No | All | — |
Slack Enterprise Grid | Files, Messages | Yes | Yes | No | All | — |
Slack Enterprise V2 | Files, Messages | Yes | Yes | Yes | All | By default, the backward scan limit is set to 1 year. If you wish
to extend this limit to more than 1 year, contact SaaS Security
Technical Support. |
Slack Pro and Business | Files, Messages in Public Channels | No | Yes | No | No | Forward Scan: scans for new assets only—not
deleted assets and content updates on assets. No Scan support
for messages in Private channels and Direct messages. |
Yammer | Threads, Attachments | No | No | No | All | — |
Zendesk | Files, Attachments | No | Yes | n/a | Internal, Public | Forward Scan: scans for new assets only—not
deleted assets and content updates on assets. |
Zoom | Chats, Messages, Transcripts | No | Yes | No | None | Scan support for messages including private
and public channels and direct messages within Team Chat. Support
for cloud-recorded, zoom meeting voice transcripts when related
settings are enabled on Zoom. |
Remediation Support on Data Security
Data Security
The following table outlines support by remediation
capability.
- When an admin quarantine is supported, unless otherwise stated, all file actions within that quarantine are also supported, includingDeleteasset,Restoreassets, andDownloadasset.
- When admin quarantine is supported, the assets that you can quarantine and the quarantine actions (for example,Download) that you can perform on them include all those that also have scan support, unless otherwise stated.
- All cloud apps support basic incident management actions, includingSend Admin AlertandCreate Incident, unless otherwise stated.
Remediation support is organized by remediation stage:
Automatic Remediation of Incidents on Data Security
Data Security
The following automatic remediation of
incidents is supported.
Cloud App | Incident Autoremediation | Notes | |||||
---|---|---|---|---|---|---|---|
Asset Quarantine | Change Sharing Remove Public Links (Files & Folders) | Notifications | |||||
User | Admin | Direct Link | Inherited Link | Notify
File Owner | Notify
via Bot | ||
Amazon S3 | Yes | Yes Only files | Yes | Yes | No | n/a | — |
Amazon Web Services (AWS) Console (Support deprecated) | No | No | Yes | No | No | n/a | — |
Bitbucket | No | No | Yes | Yes | Yes | Yes | — |
Box | Yes | Yes Only files | Yes | Yes | Yes | n/a | — |
Cisco Webex Teams | No | No | No | No | Yes | Yes | Supports deletion of messages and files. |
Citrix ShareFile | Yes | Yes Only files | Yes | Yes | Yes | n/a | — |
Confluence | Yes | Yes Only files | Yes | Yes | Yes | No | — |
Confluence Data Center | No | Yes Only attachments | No | No | No | No | — |
Dropbox - Individual Folder | Yes | Yes Only files | Yes | Yes | Yes | n/a | — |
Dropbox - Team Folder | n/a | Yes Only files | Yes | Yes | Yes | n/a | — |
GitHub | No | No | No | No | No | n/a | — |
GitHub V2 | No | No | No | Yes | No | n/a | — |
Gmail | No | No | No | No | No | n/a | — |
Google Cloud Platform (GCP) | No | Yes Only files | Yes | Yes | Yes | n/a | — |
Google Drive - My Drive | Yes | Yes | Yes | Yes | Yes | n/a | — |
Google Drive - Shared Drives | n/a | Yes | Yes | Yes | n/a | n/a | — |
Jira Data Center | No | No | No | No | Yes | No | — |
Jira Cloud | Yes | No | No | No | Yes | Yes | — |
Jive | No | No | Yes | Yes | Yes | No | — |
Microsoft Azure | No | Yes Only files | Yes, Only Folders | Yes, Only Folders | No | n/a | — |
Microsoft Exchange | No | No | No | No | No | n/a | — |
Microsoft Teams | Yes | No | n/a | n/a | Yes | n/a | Quarantine for Attachments is supported using Office 365. |
Salesforce | No | No | No | No | No | n/a | — |
ServiceNow | No | No | No | No | No | n/a | — |
Slack Enterprise Grid | No | Yes Only files | No | No | Yes | Yes | Notifications sent via Slack to the quarantine administrator
and the asset owner. |
Slack Enterprise V2 | No | No | No | No | Yes | Yes | Notifications sent via Slack to the quarantine administrator
and the asset owner. |
Yammer | No | No | No | No | No | No | — |
Zendesk | No | No | No | No | No | Yes | — |
Zoom | No | No | No | No | No | No | — |
Post-Remediation of Incidents on Data Security
Data Security
The following postremediation of incidents is supported.
Post-Remediation | Notes | |||
---|---|---|---|---|
Cloud App | Admin Quarantine Actions | |||
Delete | Restore | Download | ||
Amazon S3 | Yes | Yes | Yes | — |
Amazon Web Services (AWS) Console (Support deprecated) | No | No | No | — |
Bitbucket | No | No | No | — |
Box | Yes | Yes | Yes | — |
Cisco Webex Teams | No | No | No | Supports deletion of messages and files. |
Citrix ShareFile | Yes | Yes | Yes | — |
Confluence | Yes | Yes | Yes | — |
Confluence Data Center | Yes | Yes | Yes | — |
Dropbox - Individual Folder | Yes | Yes | Yes | — |
Dropbox - Team Folder | Yes | Yes | Yes | — |
GitHub | No | No | No | — |
GitHub V2 | No | No | No | — |
Gmail | No | No | No | — |
Google Cloud Platform (GCP) | Yes | Yes | Yes | — |
Google Drive - My Drive | Yes | Yes | Yes | When a file is restored from Admin Quarantine, collaborators
are not restored. |
Google Drive - Shared Drives | Yes | Yes | Yes | When a file is restored from Admin Quarantine, collaborators
are not restored. |
Jira Data Center | No | No | No | — |
Jira Cloud | No | No | Yes | — |
Jive | No | No | No | — |
Microsoft Azure | Yes | Yes | Yes | — |
Microsoft Exchange | No | No | No | — |
Microsoft Teams | None supported for supported scan content | Quarantine for Attachments are supported
using Office 365. | ||
Salesforce | No | No | No | — |
ServiceNow | No | No | No | — |
Slack Enterprise V2 | No | No | No | — |
Slack Pro and Business | No | No | No | — |
Yammer | No | No | No | — |
Zendesk | No | No | No | — |
Zoom | No | No | No | — |
Violation Management Support on Data Security
Data Security
Specific SaaS apps provide for violation management
of data violations:
Data Violations Support on Data Security
Data Security
The ability to display data violations and
other related data depends on the SaaS app. Unless otherwise stated,
data violations account for all supported content for
a given SaaS app.
Cloud App | Data Violations (Explore
> Data Violations) |
---|---|
Bitbucket | Yes |
Jira Data Center | Yes |
Jira Cloud | Yes |
Microsoft Teams | Yes |
Slack Enterprise V2 | Yes |
Slack Pro and Business | Yes |
Violation Actions Support on Data Security
Data Security
Supported violation management actions depend on the
SaaS app and whether you’re an administrator or asset owner.
End-user | Admin | |||||||
---|---|---|---|---|---|---|---|---|
Open | Resolved | Ignored | Delete *** | View | Not a Violation | Delete | View Dashboard | |
Bitbucket | Yes | Yes | Yes | Yes | Yes | Yes | No | Yes |
Jira Data Center | Yes | Yes | Yes | Yes | No | No | No | No |
Jira Cloud | Yes | Yes | Yes | Yes | Yes | Yes | No | Yes |
Microsoft Teams | Yes | Yes | Yes | Yes | Yes | Yes | No | Yes |
Slack Enterprise V2 | Yes | Yes | Yes | Yes | Yes | No | No | Yes |
Slack Pro and Business | Yes | Yes | Yes | Yes | Yes | Yes | Yes | Yes |
Zendesk | Yes | Yes | Yes | Yes | Yes | Yes | No | Yes |
Zoom | Yes | Yes | Yes | Yes | Yes | Yes | No | Yes |
*** Administrator can Delete the record for the data violation. End
users can Delete the asset. |
User Activity Support on Data Security
Data Security
Cloud App | Activity Monitoring (Explore
> Activities) | Activity Alerting (Policy >
User Activity Rules) | Folder Monitoring (Explore
> Assets > Events within a Folder) | Notes |
---|---|---|---|---|
Amazon S3 | Yes | Yes | No | — |
Amazon Web Services (AWS) Console (Support deprecated) | No | Yes | No | — |
Bitbucket | Yes | Yes | No | — |
Box | Yes | Yes | Yes | — |
Cisco Webex Teams | No | No | No | — |
Citrix ShareFile | Yes | Yes | No | — |
Confluence | Yes | Yes | No | — |
Confluence Data Center | Yes | No | No | — |
Dropbox - Individual Folder | Yes | Yes | Yes | — |
Dropbox - Team Folder | Yes | Yes | Yes | — |
GitHub | No | No | No | — |
GitHub V2 | No | No | No | — |
Gmail | Yes | Yes | n/a | — |
Google Cloud Platform (GCP) | Yes | Yes | n/a | — |
Google Drive - My Drive | Yes | Yes | Yes | — |
Google Drive - Shared Drives | Yes | Yes | Yes | — |
Jira Data Center | No | No | n/a | — |
Jira Cloud | Yes | Yes | n/a | — |
Jive | Yes | Yes | No | — |
Microsoft Azure | Yes | Yes | n/a | — |
Microsoft Exchange | Yes | No | n/a | — |
Microsoft Office 365 - OneDrive | Yes | Yes | No | — |
Microsoft Office 365 - SharePoint | Yes | Yes | No | — |
Microsoft Teams | Yes | No | n/a | — |
Salesforce | Yes | Yes | n/a | — |
Secure Data Space | Yes | Yes | n/a | — |
ServiceNow | Yes | Yes | n/a | — |
Slack Enterprise Grid | No | No | n/a | — |
Slack Enterprise V2 | No | No | n/a | — |
Slack Pro and Business | No | No | No | — |
Workday | Yes | Yes | No | — |
Yammer | No | No | n/a | — |
Zendesk | No | No | No | — |
Zoom | No | No | No | — |
Snippet Support on Data Security
Data Security
A snippet enables you to
investigate a pattern match.
Data Security
supports snippets for most cloud
apps. However, if Data Security
does not support snippets for your cloud
app or the specific asset type (file vs. chat),
the Request Snippets
button does not display in
Matching Data Patterns
. Data Security
’s ability
to support snippets for your cloud app highly depends on the capabilities available
in cloud app vendor’s public API.