SaaS Security
Match Criteria for Data Asset Policies
Table of Contents
Match Criteria for Data Asset Policies
Define the match criteria that a data asset policy uses when the service scans for
matches.
Define the match criteria that a data asset policy uses when the service scans for matches.
Match Criteria for a Data Asset Policy
When you add a
new asset rule or you modify a policy rule, you define the match
criteria that the data asset policy uses when Data Security scans for
matches. The service compares all of the information it discovers against the
enabled data asset policies and identifies incidents and exposures in every asset
across all your monitored SaaS applications. Match criteria is critical for
successful discovery of risks in SaaS application usage across your organization so,
when you set the match criteria, you must carefully consider the thresholds, types
of information, and risks associated with how assets are shared. Use match criteria
to enforce compliance with your corporate acceptable use policy.
You can also use the Advanced tab to define the match criteria
using expressions. Use the tooltip at the right side of the field to learn about the
various advanced search queries.
The
fields policy.name,
incident.category, email.sent,
and assigned.to in the Advanced
tab are:
- Applicable only when you perform an advanced search in the Data Assets page.
- Not applicable when you create a policy (using ).
Match Criteria | Description |
|---|---|
|
Activity
|
Select the asset access and modification activities within a
selected time frame to match. For example, activities can
include Accessed, Not
Accessed, Modified, and
Not Modified. Time frames include
in the past week, in the
past month, and in the past 6
months.
|
|
Asset Name
|
Enter the Asset Name to include or exclude
in the match results. Select either
Equals to match the asset, or
Does not Equal to exclude the asset
from matching.
|
|
Cloud Applications
|
Select the managed applications to scan and match. By default,
all cloud apps you added to Data Security are scanned,
but you can Rescan a Managed
Cloud App.
|
|
Data Pattern
|
Select the available data patterns to match, including predefined
or custom data patterns or a file property you defined when you
create a custom data
pattern. Specify your include or exclude logic. Enter
the number of Occurrences and
Confidence (Confidence Level)
required to display a data pattern match.
|
|
Data Profiles
|
Select the available data profiles to match when you create a custom data
profile.
|
|
Exposure
|
Select the match conditions for how the asset is shared (Public,
External, Company, or Internal).
|
|
Label
|
Select the app (Google Drive) and the data label that you fetched
for that app.
For Microsoft Labels,
use custom DLP patterns as match criteria. |
|
Extension
|
Enter the File Extension to include or
exclude in the match results. Select either
Equals to match the asset file
extension, or Does not Equal to exclude
the asset file extension from matching.
|
|
File Hash (SHA256)
|
Files are scanned using WildFire analysis to detect and protect
against malicious portable executables (PEs) and known threats
based on file hash. Enter the Hash
(SHA256) details of the file to match. Select
Equals (include in matching), or
Does not Equal (exclude in
matching).
|
|
Owner
|
Enter the email address for the asset
Owner to
Include or
Exclude in the match results. You can
add one or more Directory groups
|
|
Owner Group
|
To enforce group-based policy using File Owner’s
Group, you must first Integrate
Cloud Identity Engine with Data Security.
Select either Equals, or Does
not Equal and the Identity Provider Group to
which the file owner must belong. You can also select
Not Available if you want to enforce
an action for any users who are not identified either because
the email address is unavailable or because they belong to an AD
group that is not being scanned by Data Security.
|
Trust State occurrence | When you Define Untrusted Users and Domains or if you are matching on an asset's trust state, all
assets shared with a user in the selected
Trusted,
Untrusted, or Anyone Not
Trusted users list are detected as a match.
Specify the number of occurrences (such as
Any, More
than, Fewer than, or
Between with whom a file must be
shared to trigger a match. |
