View Asset Snippets

Learn how to analyze the content that triggered a match.
A snippet is evidence or identifiable information associated with a pattern match. There are times when you need to investigate the content behind an incident. View a snippet, if available, to:
request-snippets.png
  1. Locate the specific asset.
    • Select
      Explore
      Quarantine
      to view a list of assets that have been quarantined.
    • Select
      Explore
      Assets
      to select from a list of all assets.
    • Select
      Explore
      Incidents
      to view a list of incidents.
  2. Click
    Request Snippets
    .
    Wait while the service retrieves the data.
    • Missing button
      —If your cloud app or the asset type (file vs. chat) is not supported, the button does not appear. Support highly depends on the API made available by the cloud app.
    • Greyed-out button
      —If it’s an asset that was unavailable, the button is disabled.
    • Blurry snippet
      —Initially, the snippet is blurry. After the service verifies that you have the required role priviledges and retrieves the snippet, clear text displays.
    • Missing snippet text
      —To intentionally obscure sensitive data, depending on your data masking, some of the text in the snippet might not be in clear text.
    • Performance
      —To speed up on-demand performance, the service fetches the snippet from cache when available; if unavailable, the snippet is automatically downloaded from the cloud app.
    • Mismatch
      —When you compare a snippet to its corresponding download file, it’s possible to overlook a match: Prisma SaaS can match on an embedded text table, or image in the main document. Look closely at all embedded files.
  3. Analyze the snippet, then make an assessment.

Recommended For You