: Begin Scanning a Box App
Focus
Focus

Begin Scanning a Box App

Table of Contents

Begin Scanning a Box App

Use these steps to connect the Box application to
Data Security
to begin scanning assets for policy violations.
This feature is available for Business, Business Plus, and Enterprise versions only. Personal accounts are not supported.
To connect Box to
Data Security
and begin scanning files and folders, you need to:
  • Ensure that you have a Box account with has sufficient privileges.
  • Grant
    Data Security
    access to Box.
  • Add the Box app to
    Data Security
    , providing
    Data Security
    information about your Box.
Support for automated remediation capabilities varies by SaaS application.

Prepare To Add Box App

Before you add the Box app, perform the prerequisites steps to make use of all the capabilities that the app supports which help in an efficient onboarding experience.
  1. (
    Recommended
    ) Add your Box app domain as an internal domain.
  2. (
    Optional
    ) Enable group-based Enable Group-based Selective Scanning (Beta).
    If you plan to use selective scanning using Azure Active Directory. You must retrieve your Azure AD group information before adding your Box application so
    Data Security
    can discover and scan assets belonging to the user groups you want to monitor.
  3. Next step
    : Proceed to Add Box App.

Add Box App

In order for
Data Security
to scan assets, you must consent to specific permissions during adding the Box app. Without the requested permissions,
Data Security
can't authenticate with Box and can't scan assets, even after you successfully install the Box app.
  1. Ensure that the Box account you plan to use with
    Data Security
    has sufficient privileges.
    Enabling the
    Edit settings for your company
    option suppresses email notifications. If you don't enable this setting, every collaborator on an asset receives an email notification each time
    Data Security
    accesses an asset. When you suppress an email notification, actions will still appear in the user’s update feeds and in the audit logs.
    To connect
    Data Security
    , log in to a Box account with administrator privileges. Make sure the following settings are enabled:
    1. From within the Box app, select
      Admin Console
      Users and Groups
      and select the administrator account you want to use.
    2. Allow this user to see all managed users
      .
  2. To add the Box application to
    Data Security
    , go to
    Data Security
    Applications
    Add Application
    Box
    .
    1. Click
      Connect to Box Account
      .
    2. Enter the email address and password for the administrator account you want
      Data Security
      to use when connecting to Box and then click
      Authorize
      .
      Data Security
      validates the administrator account and if the account has the right authentication permissions to access all the Box assets. If the account does not have adequate permissions, an onscreen status displays an error alerting you to fix the issue.
    3. After authentication succeeds, select
      Grant access to Box
      .
      After authentication,
      Data Security
      adds the new Box app to the Cloud Apps list as
      Box
       n, where n is the number of Box app instances that you connected to
      Data Security
      . For example, if you added one Box app, the name displays as
      Box 1
      . You’ll specify a descriptive name soon.
  3. Next step
    : Proceed to Customize Box App.

Troubleshooting Onboarding for Box App

To ensure that your app has onboarded correctly without any issues in authentication or permissions, Data Security performs validation checks between the onboarding and scanning process. You can start scanning only after a successful validation. For Box, the following validation happens:
  • App Authentication
After the validation is successful,
Data Security
displays the sample user activities and data assets:
If the
App Authentication
check fails, try the following:
  1. Ensure you have administrator permissions.
  2. Go to your Box app directory (
    https://<custom domain>.app.box.com/app-center?myApps=true
    ) and check if your Palo Alto Networks application is listed in the list of installed apps. Following are the app names for specific regions:
    • India region: Palo Alto Networks NG-CASB - India
    • Australia region: Palo Alto Networks NG-CASB - AUS
    • Japan region: Palo Alto Networks NG-CASB - JP
    • UK region: Palo Alto Networks NG-CASB - UK
    • EU region: Aperture EU by Palo Alto Networks
    • APAC region: Aperture APAC by Palo Alto Networks
    • US region: Aperture by Palo Alto Networks
Handling Errors
To understand your error messages and ways to resolve them, see:
If the issue persists, contact SaaS Security Technical Support.

Customize Box App

After you add the Box app, customize the app to make use of capabilities that are unique to this app.
  1. (
    Optional
    ) Specify an
    Alternative account for quarantined files
    .
    You can specify a different Box account (in email address format) for the quarantine administrator for precise assignment of incident management responsibilities. If you choose not to specify an alternative account,
    Data Security
    uses the onboarding account to quarantine files in the
    Admin Quarantine
    folder. The Box account for the quarantine administrator does not need to have admin privileges. After you define this quarantine administrator, you can't modify the setting without deleting the Box app and repeating the onboarding process; therefore, use a service account that persists as administrators join and leave your organization.
  2. Click
    Done
    to save your changes.
  3. (
    Optional
    ) Enable group-based selective scanning.
    If you have not already done so, instruct
    Data Security
    to retrieve your Azure AD group information, then return to this step to choose the user groups.
  4. Next step
    : Proceed to Start Scanning and Monitor Results.

Start Scanning and Monitor Results

When you add a new cloud app, then enable scanning,
Data Security
automatically scans the cloud app against the default data patterns and displays the match occurrences. You can take action now to improve your scan results and identify risks.
  1. To Start scanning the new Box app for risks, go to
    Data Security
    Applications
    Box
    Enable Scanning
    .
  2. During the discovery phase, as
    Data Security
    scans files and matches them against enabled policy rules, verify that your default policy rules are effective. If the results don’t capture all the risks or you see false positives, proceed to the next step to improve your results.
  3. (
    Optional
    ) Modify match criteria for existing policy rules.
  4. (
    Optional
    ) Add new policy rules.
    Consider the business use of your cloud app, then identify risks unique to your enterprise. As necessary, add new:
  5. (
    Optional
    ) Configure or edit a data pattern.
    You can Configure Data Patterns to identify specific strings of text, characters, words, or patterns to make it possible to find all instances of text that match a data pattern you specify.

Recommended For You