>
    Begin Scanning a Box App
    Focus
    Download PDF
    Focus
    1. Home
    2. SaaS Security
    3. Onboard Sanctioned SaaS Apps to Data Security
    4. Begin Scanning a Box App
    Download PDF
    SaaS Security

    Begin Scanning a Box App

    Table of Contents

    Begin Scanning a Box App

    Use these steps to connect the Box application to Data Security to begin scanning assets for policy violations.
    Where Can I Use This?What Do I Need?
    • Strata Cloud Manager
    • Data Security license
    Or any of the following licenses that include the Data Security license:
    • CASB-X
    • CASB-PA
    This feature is available for Business, Business Plus, and Enterprise versions only. Personal accounts are not supported.
    Support for automated remediation capabilities varies by SaaS application.

    Supported Content

    The following table lists the supported content for the Box app.
    Support For
    Details
    Scan Content
    		Files, Folders
    Backward Scan
    Yes
    Forward Scan
    Yes
    Selective Scan
    Yes
    User Activities
    • Activity Monitoring—Yes
    • Activity Alerting—Yes
    • Folder Monitoring—Yes
    Remediation Actions
    • Change Sharing—Yes
    • User Quarantine—Yes
    • Admin Quarantine—Yes (Only Files)
    Notifications
    • Notify File Owner—Yes
    • Notify Via Slack—Yes (applicable only if you have onboarded Slack Enterprise or Slack Pro and Business)
    Post-Remediation Actions (Actions after Admin Quarantine)
    Yes
    Exposure
    All
    Snippet Support
    Yes
    Known License and Version restrictions
    Supported Versions
    • Business
    • Business Plus
    • Enterprise
    Caveats and Notes
    None

    Onboard Box App

    To onboard and start scanning your Box app instance, you must have an Admin or a Co-admin account. Further, if you are onboarding as a Co-admin, you must have the Co-owner permissions enabled to be able to scan your box app.
    1. Prerequisites to be completed before onboarding
      1. (Recommended) Add your Box app domain as an internal domain.
      2. (Optional) Enable group-based Enable Group-based Selective Scanning.
        Integrate Cloud Identity Engine with Data Security if you plan to use selective scanning before adding your Box application so that Data Security can discover and scan assets belonging to the user groups you want to monitor.
      3. Ensure that the Box account you plan to use with Data Security has sufficient privileges.
        Enabling the Edit settings for your company option suppresses email notifications. If you don't enable this setting, every collaborator on an asset receives an email notification each time Data Security accesses an asset. When you suppress an email notification, actions will still appear in the user’s update feeds and in the audit logs.
      4. From within the Box app, select Admin ConsoleUsers and Groups and select the administrator account you want to use and Allow this user to see all managed users.
      5. Next step: Proceed to Add Box App to Data Security.
    2. Add Box App to Data Security
      1. Log in to Strata Cloud Manager.
      2. Select ManageConfigurationSaaS SecurityData SecurityApplicationsAdd ApplicationBox.
      3. Click Connect Box to Data Security.
      4. Enter the email address and password for the administrator account you want Data Security to use when connecting to Box and then Authorize.
        Data Security validates the administrator account and if the account has the right authentication permissions to access all the Box assets. If the account does not have adequate permissions, an onscreen status displays an error alerting you to fix the issue.
      5. After authentication succeeds, Grant access to Box.
        After you grant access to Box, on successful onboarding, the following message is displayed.
      6. Click View Onboarding Status to know if the validation checks have passed. You will be able to start scanning only after successful validation.
      7. Optional After authentication, Data Security adds the new Box app to the Cloud Apps list as Box n, where n is the number of Box app instances that you connected to Data Security. For example, if you added one Box app, the name displays as Box 1. You’ll specify a descriptive name soon.
      8. Next step: Proceed to Start Scanning the Box App and Monitor Results.

    Troubleshooting Onboarding for Box App

    To ensure that your app has onboarded correctly without any issues in authentication or permissions, Data Security performs validation checks between the onboarding and scanning process. You can start scanning only after a successful validation. For Box, the following validation happens:
    • App Authentication
    After the validation is successful, Data Security displays the sample user activities and data assets:
    If the App Authentication check fails, try the following:
    1. Ensure you have administrator permissions.
    2. Go to your Box app directory (https://<custom domain>.app.box.com/app-center?myApps=true) and check if your Palo Alto Networks application is listed in the list of installed apps. Following are the app names for specific regions:
      • India region: Palo Alto Networks NG-CASB - India
      • Australia region: Palo Alto Networks NG-CASB - AUS
      • Japan region: Palo Alto Networks NG-CASB - JP
      • UK region: Palo Alto Networks NG-CASB - UK
      • EU region: Aperture EU by Palo Alto Networks
      • APAC region: Aperture APAC by Palo Alto Networks
      • US region: Aperture by Palo Alto Networks
    Handling Errors
    To understand your error messages and ways to resolve them, see:
    If the issue persists, contact SaaS Security Technical Support.

    Customize Box App

    After you add the Box app, customize the app to make use of capabilities that are unique to this app.
    1. (Optional) Specify an Alternative account for quarantined files.
      You can specify a different Box account (in email address format) for the quarantine administrator for precise assignment of incident management responsibilities. If you choose not to specify an alternative account, Data Security uses the onboarding account to quarantine files in the Admin Quarantine folder. The Box account for the quarantine administrator does not need to have admin privileges. After you define this quarantine administrator, you can't modify the setting without deleting the Box app and repeating the onboarding process; therefore, use a service account that persists as administrators join and leave your organization.
    2. Click Done to save your changes.
    3. Next step: Proceed to Selective Scanning on Box App.

    Selective Scanning on Box App

    Perform selective scanning on your Box app.
    1. (Optional) Enable group-based selective scanning.
      Integrate Cloud Identity Engine with Data Security if you plan to use selective scanning before adding your Box application so that Data Security can discover and scan assets belonging to the user groups you want to monitor.
      You cannot change the status of selective scanning for your Box app that has already started scanning.
    2. You can choose to either Scan or Exclude From Scan your user groups.
    3. Choose your groups from the Available Groups list and move them to the Selected Groups list.
    4. Save your changes.
      You can perform each of the above four steps any number of times and make any changes as long as you have not started scanning your Box app. However, if you have started scanning, all operations related to selective scanning are disabled.
    5. Next step: Proceed to Start Scanning and Monitor Results.

    Start Scanning and Monitor Results

    When you add a new cloud app, then enable scanning, Data Security automatically scans the cloud app against the default data patterns and displays the match occurrences. You can take action now to improve your scan results and identify risks.
    1. To start scanning the new Box app for risks, select ManageConfigurationSaaS SecurityData SecurityApplicationsBoxView Settings...Start Scanning.
    2. Monitor the scan results.
      During the discovery phase, as Data Security scans files and matches them against enabled policy rules, verify that your default policy rules are effective. If the results don’t capture all the risks or you see false positives, proceed to the next step to improve your results.
    3. (Optional) Modify match criteria for existing policy rules.
    4. (Optional) Add new policy rules.
      Consider the business use of your cloud app, then identify risks unique to your enterprise. As necessary, add new:
    5. (Optional) Configure or edit a data pattern.
      You can Configure Data Patterns to identify specific strings of text, characters, words, or patterns to make it possible to find all instances of text that match a data pattern you specify.

    © 2025 Palo Alto Networks, Inc. All rights reserved.