Support on Data Security
Focus
Focus
SaaS Security

Support on Data Security

Table of Contents

Support on Data Security

Learn about the cloud apps, file types, content, languages, and remediation capabilities that are supported on Data Security.
Where Can I Use This?What Do I Need?
  • NGFW (Managed by Strata Cloud Manager)
  • Prisma Access (Managed by Strata Cloud Manager)
  • Data Security license
Or any of the following licenses that include the Data Security license:
  • CASB-X
  • CASB-PA
The following information provides a comprehensive look at support on Data Security and is uniquely tied to a given cloud app’s API.
This support does not include planned support; if you have an interest in a specific support, contact your SaaS Security Support Engineer (SE).

Supported SaaS Applications on Data Security

Data Security provides a consistent security policy for your applications to detect data exfiltration and malware propagation.
SaaS applications are cloud apps owned and managed by an application service provider, but you retain full control of the data, including who can create, access, share, and transfer information stored in the hosted application. Although most SaaS applications allow you to configure rules about sharing and exposing data, rules vary from application to application, which makes it challenging to ensure consistent security policy across all applications, assets, and users.
Data Security provides centralized policy and enforcement for your applications so you can protect your corporate data at all times. The service scans content to detect data exfiltration and malware propagation, monitors user activity, and provides activity-based alerting to notify you of malicious or risky behavior. This visibility allows you to assess incidents, quarantine users and data, and remediate any violations to protect against threats caused by malware, inadvertent sharing, excessive permissions, and data exposure.
The events you see for SaaS Security (either on the classic SaaS Security Console or on the new Cloud Management Console) are of two types—legacy and new. All legacy connectors present each and every event independent of DLP match criteria. However, new connectors present only those events that meet the DLP match criteria. Check your connector type in the following table to know how events are presented.
Cloud Application
Version Support
Description &
Scan and Remediation Support
Amazon S3
(Legacy)
N/A
On the Simple Storage Service (S3), Data Security scans files in S3 buckets.
Bitbucket
(New)
Free
Standard
Premium
Bitbucket Cloud is a Git repository management solution.
Box
(Legacy)
Business
Business Plus
Enterprise
Box is a cloud-based file sharing and collaboration application.
ChatGPT
Enterprise
ChatGPT is a chatbot and virtual assistant application.
Cisco Webex Teams
(Legacy)
Starter
Plus
Business
Enterprise
Webex Teams is a cloud-based teamwork application that supports file sharing and secure messaging.
If you're using the Standard service plan for Cisco Webex Teams, consider upgrading to the Pro Pack service plan before you add the app to Data Security. The Pro Pack plan provides visibility into events such as messages and files posted on the app, and users added to spaces, occurring more than 90 days ago.
Confluence
(Legacy)
Confluence Cloud
Confluence is a centralized platform for knowledge sharing, document management, and project planning.
Data Security does not scan Confluence Free versions.
Confluence Data Center
(New)
7.8 to 7.20
8.0
Confluence Data Center is a centralized platform for knowledge sharing, document management, and project planning.
Dropbox
(Legacy)
Business Standard
Advanced
Enterprise
Dropbox is a personal cloud storage service used for file sharing and collaboration.
GitHub
(New)
Pro
GitHub is a collaborative web-based service that helps teams with source control management.
Gmail
(Legacy)
Business
Enterprise
Gmail is a web-based email service. In addition to scanning content for this cloud app, Data Security enables you to identify if users have configured email forwarding rules in their Inbox.
Google Cloud Storage
(Legacy)
Business
Enterprise
Google Cloud Storage is a cloud computing service.
Google Drive
(Legacy)
Business
Enterprise
Google Drive is a cloud storage and file backup application. Both My Drive and Shared Drives are supported.
Jira
(New)
Free
Standard
Premium
Enterprise
Jira is a suite of agile work management solutions that enable team collaboration.
Jira Data Center
(New)
Free
Standard
Premium
Enterprise
Jira Data Center is a suite of agile work management solutions that enable team collaboration.
Microsoft Azure Storage
(Legacy)
Business and Enterprise
Microsoft Azure Storage is a Cloud Computing service.
Microsoft Exchange
(Legacy)
Home and Firstline Workforce are not supported
Microsoft Exchange is a web-based email service. In addition to scanning content for this cloud app, Data Security enables you to identify users who have configured email retention policies other than those policies configured by the corporate administrator, and if users have configured email forwarding rules in their Inbox.
Microsoft Teams
(New)
Microsoft 365 Business Standard
On Microsoft Teams, you can scan channel messages and direct chats. Attachments are supported using Office 365.
Due to new Microsoft licensing requirements, Microsoft Teams connector will work only for customers running the E5 licenses.
Office 365
(Legacy)
Home and Firstline Workforce are not supported
Office 365 support includes all versions of OneDrive and SharePoint.
Data Security will scan files uploaded by external collaborators only if those external collaborators are added to the Azure Active Directory as External.
Salesforce
(Legacy)
Standard
Premier
Sandbox
Salesforce is a customer relationship management (CRM) service. Data Security scans both structured and unstructured content.
ServiceNow
(Legacy)
N/A
ServiceNow is cloud-based tool to help businesses create digital workflows to manage operations.
ShareFile
(Legacy)
Team
Business
Virtual Data Room
ShareFile is a file synchronization and storage service.
Slack Enterprise
Slack Enterprise (new)
Slack is a cloud-based team collaboration tool.
In addition to the Grid license, Data Security also supports the Select license for Slack Enterprise.
Slack Pro and Business
Pro and Business (new)
Slack is a cloud-based team collaboration tool.
In addition to the Grid license, Data Security also supports the Select license for Slack Enterprise V2.
Workday
N/A
Workday is a provider of enterprise cloud applications for finance and human resources, helping customers adapt and thrive in a changing world.
Zendesk
(New)
Free
Team
Professional
Enterprise
Zendesk Support (aka Zendesk Suite) is an integrated help center and community forum with the ability to interact with customers using messaging, live chat, social, email, and voice.
Zoom
(New)
Business
Enterprise
Zoom is a cloud-based team collaboration tool.

Supported Content, Remediation and Monitoring

View the list of supported SaaS applications and their supported remediation options on Data Security.
Before you add a cloud app to Data Security, learn about the scan, remediation, and monitoring features that Data Security supports for your cloud app. Usually when a remediation capability isn't supported, it’s due to the cloud app’s API. However, as a cloud app’s API changes often Data Security is able to expand support. Unless otherwise stated, forward scan includes new assets, deleted assets, and updated content on assets. Additionally, sometimes a feature isn't relevant to a cloud app’s paradigm (for example, the cloud app doesn’t have folders), and so the feature isn’t applicable.
  • Content Support on Data Security
  • Remediation Support on Data Security
  • Incident Management Support on Data Security
  • User Activity Support on Data Security
  • Snippet Support on Data Security

Content Support on Data Security

Scan content support is different from remediation support. Data Security can scan content based on supported file types and supported languages, but within that remediation depends on the cloud app. Additionally, Data Security offers different types of scan methods based on the type of cloud app and not all exposure levels apply to some cloud apps. Additionally, unless otherwise stated, Forward Scan typically includes new assets, deleted assets, and content updates on assets.
Cloud App
Scan Content
Scan Methods
Exposure
Notes
Backward Scan
Forward Scan
Group-Based
Amazon S3
Buckets, Files
Yes
Yes
Multi-account
Internal, External,Public
Bitbucket
Commit files, Repository
Yes
Yes
n/a
Internal, Public
By default, the backward scan limit is set to 1 year. If you wish to extend this limit to more than 1 year, contact SaaS Security Technical Support.
Box
Files, Folders
Yes
Yes
Yes
All
ChatGPT Enterprise
Messages, files uploaded, and files generated by GPT
Yes
Yes
No
Internal, External, Public, Company
Cisco Webex Teams
Rooms, Messages, Files
Yes
Yes
No
Internal, External, Public
Confluence
Page content, Attachments, Comments
Yes
Yes
No
Internal, External,Public
Internal exposure is supported only when you have your email visibility set to global visibility in the Confluence app. Data Security does not scan personal spaces.
Data Security does not scan Confluence Free versions.
Confluence Data Center
Page content, Attachments, Comments
Yes
Yes
No
Internal, External, Company
By default, the backward scan limit is set to 1 year. If you wish to extend this limit to more than 1 year, contact SaaS Security Technical Support.
Dropbox ( Individual Folder and Team Folder)
Files, Folders
Yes
Yes
No
All
GitHub
Files, Folders
Yes
Yes
No
Internal, Public
Backward scanning is supported up to 1 year only.
Gmail
Email content, Attachments
No
Yes
No
Internal, External
For internal emails, only attachments are scanned. For external emails, both email content and attachments are scanned.
Google Cloud Storage (GCP)
Projects, Buckets, Files
Yes
Yes
Yes
Internal, External,Public
Google Drive - My Drive
Files, Folders
Yes
Yes
Yes
All
Google Drive - Shared Drives
Files, Folders
Yes
Yes
Yes
All
Jira
Issue Descriptions, Comments, Attachments, Projects
Yes
Yes
n/a
No
By default, the backward scan limit is set to 1 year. If you wish to extend this limit to more than 1 year, contact SaaS Security Technical Support.
Jira Data Center
Issue Descriptions, Comments, Attachments, Projects
Yes
Yes
n/a
No
Data Security performs a backward scan spanning 15 years from the date of onboarding for both existing and new customers. The default rate limit is 100 requests per second, but you can also set your own limit. This rate limit is divided between forward and backward scans. When the rate limit reaches 60% of the threshold, the backward scan halts. However, it resumes once the rate limit falls below this threshold. The recommended rate limit is 10 requests per second. A minimum rate limit of 2 requests per second is recommended so that your forward scanning is not adversely affected.
Microsoft Azure Storage
Storage Accounts, Containers, Files
Yes
Yes
Yes
Internal, External,Public
Microsoft Exchange
Email content, Attachments
No
Yes
No
Internal, External
For internal emails, only attachments are scanned. For external emails, both email content and attachments are scanned.
Microsoft Office 365 - OneDrive
Files, Folders
Yes
Yes
Yes
All
Data Security will scan files uploaded by external collaborators only if those external collaborators are added to the Azure Active Directory as External.
Microsoft Office 365 - SharePoint
Files, Folders
Yes
Yes
No
All
Microsoft Teams
Channel Messages, Direct Chats
No
Yes
n/a
Internal, External,Company
Attachments are supported using Office 365.
Due to new Microsoft licensing requirements, Microsoft Teams connector will work only for customers running the E5 licenses.
Salesforce
Files, Tables, Chatter body
Yes
Yes
No
All
Backward or Forward scan: the service performs Backward scan until it reaches current time, then performs Forward scan.
Content: While Data Security stores the metadata for all unstructured files, it stores structured file data selectively. For example, a Salesforce Chatter message has structured data and is stored only when the content in the message matches a defined data pattern but an attachment on Salesforce Chatter has unstructured data, so Data Security scans the attachment and stores the metadata.
ServiceNow
Tables, Attachments
Yes
Yes
No
All
ShareFile
Files, Folders
Yes
Yes
No
All
Slack Enterprise
Files, Messages
Yes
Yes
No
All
  • Currently, all Slack Enterprise asset exposure is set as Internal only.
  • By default, the backward scan limit is set to 1 year. If you wish to extend this limit to more than 1 year, contact SaaS Security Technical Support.
Slack Pro and Business
Files, Messages
No
Yes
No
No
Forward Scan: scans for new assets only—not deleted assets and content updates on assets.
If you onboarded your app instance before 7 December 2024: Reauthenticate your instance so that Data Security scans private channels and direct messages.
Zendesk
Files, Attachments
No
Yes
n/a
Internal, Public
Forward Scan: scans for new assets only—not deleted assets and content updates on assets.
Zoom
Chats, Messages, Transcripts
No
Yes
No
None
Scan support for messages including private and public channels and direct messages within Team Chat.
Support for cloud-recorded, zoom meeting voice transcripts when related settings are enabled on Zoom.

Remediation Support on Data Security

The following table outlines support by remediation capability.
  • When an admin quarantine is supported, unless otherwise stated, all file actions within that quarantine are also supported, including Delete asset, Restore assets, and Download asset.
  • When admin quarantine is supported, the assets that you can quarantine and the quarantine actions (for example, Download) that you can perform on them include all those that also have scan support, unless otherwise stated.
  • All cloud apps support basic incident management actions, including Send Admin Alert and Create Incident, unless otherwise stated.

Automatic Remediation of Incidents on Data Security

The following automatic remediation of incidents is supported.
Cloud App
Incident Autoremediation
Notes
Asset Quarantine
Change Sharing
Remove Public Links
(Files & Folders)
Notifications
User
Admin
Direct Link
Inherited Link
Notify File Owner
Notify via Bot
Amazon S3
Yes
Yes
Only files
Yes
Yes
No
n/a
Bitbucket
No
No
Yes
Yes
Yes
Yes
Box
Yes
Yes
Only files
Yes
Yes
Yes
n/a
ChatGPT
No
No
No
No
Yes
n/a
Cisco Webex Teams
No
No
No
No
Yes
Yes
Supports deletion of messages and files.
Confluence
No
Yes
Only files
No
No
Yes
No
Confluence Data Center
No
Yes
Only attachments
No
No
No
No
Dropbox - Individual Folder
Yes
Yes
Only files
Yes
Yes
Yes
n/a
Dropbox - Team Folder
n/a
Yes
Only files
Yes
Yes
Yes
n/a
GitHub
No
No
No
Yes
No
n/a
Gmail
No
No
No
No
No
n/a
Google Cloud Storage (GCP)
No
Yes
Only files
Yes
Yes
Yes
n/a
Google Drive - My Drive
Yes
Yes
Yes
Yes
Yes
n/a
Google Drive - Shared Drives
n/a
Yes
Yes
Yes
n/a
n/a
Jira Data Center
No
No
No
No
Yes
No
Jira
Yes
No
No
No
Yes
Yes
Microsoft Azure Storage
No
Yes
Only files
Yes, Only Folders
Yes, Only Folders
No
n/a
Microsoft Exchange
No
No
No
No
No
n/a
Microsoft Office 365 - OneDrive
Yes
Yes
Only files
Yes
No
Yes
n/a
Microsoft Office 365 - SharePoint
No
Yes
Only files
Yes
No
Yes
n/a
Microsoft Teams
Yes
No
n/a
n/a
Yes
n/a
Quarantine for Attachments is supported using Office 365.
Salesforce
No
No
No
No
No
n/a
ServiceNow
No
No
No
No
No
n/a
ShareFile
No
Yes
Only files
Yes
Yes
Yes
n/a
Slack Enterprise
No
No
No
No
Yes
Yes
Notifications sent via Slack to the quarantine administrator and the asset owner.
Supports deletion of messages and files.
Slack Pro and Business
No
No
No
No
No
Yes
Zendesk
No
No
No
No
No
Yes
Zoom
No
No
No
No
No
No

Manual Remediation Support on Data Security

The ability to manually remediate assets depends on your SaaS app.
Cloud App
Manual Remediation
ChatGPT Enterprise
The following manual remediation activities are supported:
  • Delete Conversation
  • Unshare CustomGPT
Slack Enterprise
Delete Asset
The Delete Asset action is permanent. You cannot restore the deleted asset.

Post-Remediation of Incidents on Data Security

The following post remediation of incidents is supported.
Post-Remediation
Notes
Cloud App
Admin Quarantine Actions
Delete
Restore
Download
Amazon S3
Yes
Yes
Yes
Bitbucket
No
No
No
Box
Yes
Yes
Yes
ChatGPT
No
No
No
Cisco Webex Teams
No
No
No
Supports deletion of messages and files.
Confluence
Yes
Yes
Yes
Confluence Data Center
Yes
Yes
Yes
Dropbox - Individual Folder
Yes
Yes
Yes
Dropbox - Team Folder
Yes
Yes
Yes
GitHub
No
No
No
Gmail
No
No
No
Google Cloud Storage (GCP)
Yes
Yes
Yes
Google Drive - My Drive
Yes
Yes
Yes
When a file is restored from Admin Quarantine, collaborators are not restored.
Google Drive - Shared Drives
Yes
Yes
Yes
When a file is restored from Admin Quarantine, collaborators are not restored.
Jira Data Center
No
No
No
Jira
No
No
Yes
Microsoft Azure Storage
Yes
Yes
Yes
Microsoft Exchange
No
No
No
Microsoft Office 365 - OneDrive
Yes
Yes
Yes
Microsoft Office 365 - SharePoint
Yes
Yes
Yes
Microsoft Teams
None supported
Quarantine for Attachments are supported using Office 365.
Salesforce
No
No
No
ServiceNow
No
No
No
ShareFile
Yes
Yes
Yes
Slack Enterprise
No
No
No
Slack Pro and Business
No
No
No
Zendesk
No
No
No
Zoom
No
No
No

Incident Management Support on Data Security

Specific SaaS apps provide for incident management of incidents:

Incidents Support on Data Security

The ability to display incidents and other related data depends on the SaaS app. Unless otherwise stated, incidents account for all supported content for a given SaaS app. Incidents are created based on the policy that is configured. It can either be the default policy or a custom policy

User Activity Support on Data Security

Cloud App
Activity Monitoring
Activity Alerting
Folder Monitoring
Notes
Amazon S3
Yes
Yes
No
Bitbucket
Yes
Yes
No
Box
Yes
Yes
Yes
ChatGPT
No
No
No
Cisco Webex Teams
No
No
No
Confluence
Yes
Yes
No
Confluence Data Center
Yes
No
No
Dropbox - Individual Folder
Yes
Yes
Yes
Dropbox - Team Folder
Yes
Yes
Yes
GitHub
No
No
No
Gmail
Yes
Yes
n/a
Google Cloud Storage (GCP)
Yes
Yes
n/a
Google Drive - My Drive
Yes
Yes
Yes
Google Drive - Shared Drives
Yes
Yes
Yes
Jira Data Center
No
No
n/a
Jira
Yes
Yes
n/a
Microsoft Azure Storage
Yes
Yes
n/a
Microsoft Exchange
Yes
No
n/a
Microsoft Office 365 - OneDrive
Yes
Yes
No
Microsoft Office 365 - SharePoint
Yes
Yes
No
Microsoft Teams
Yes
No
n/a
Salesforce
Yes
Yes
n/a
ServiceNow
Yes
Yes
n/a
ShareFile
Yes
Yes
No
Slack Enterprise
No
No
n/a
Slack Pro and Business
No
No
No
Workday
Yes
Yes
No
Zendesk
No
No
No
Zoom
No
No
No

Snippet Support on Data Security

A snippet enables you to investigate a pattern match. Data Security supports snippets for most cloud apps. However, snippets might not be available for you if:
  • Data Security does not support snippets for your cloud app or the specific asset type (file vs. chat)
  • You have not set Write access for Request Snippets in Common Services.
Data Security’s ability to support snippets for your cloud app highly depends on the capabilities available in cloud app vendor’s public API.

Supported File Types for Scanning Assets

Learn about the file type categories that Data Security supports for asset scanning.
Data Security supports the file type categories listed below to scan assets. Data Security extracts metadata and contextual content for more than 100 file formats. For the supported categories listed below, Data Security supports all Apache Tika file types.
The following table lists the supported file categories. The example file types don't represent a complete list—rather, commonly used formats: this list changes as the underlying technology supports new file types. Use the examples to gauge the scope of the file categories.

File Type Support for Scanning

File Type Category
Scanning Support
Example File Types
Hyper Text Markup Language
htm, xhtml, ETC.
XML and derived formats
ooxml, ETC.
Microsoft Office, OLE-based and XML-based
doc, docx, ETC.
Source code
Java, C, C++, ETC.
Mail
MS Outlook msg, MS Outlook pst, RFC 822, mbox, ETC.
Executable programs and libraries
Windows EXE, Linux/BSD, ETC.
Open Document Format
odf, ETC.
iWorks
numbers, pages, keynote, ETC.
Portable Document Format
pdf, ETC.
Electronic Publication Format
ePub, ETC.
Rich Text Format
rtf, ETC.
Compression and packaging format
tar, rar, zip, 7zip, ETC.
Text
txt, ETC.
Feed and Syndication
RSS, Atom, IPTC ANPA, ETC.
Help formats
chm, ETC.
Java class files and archives
jar, ETC.
Font formats
TrueType, Adobe Font, ETC.

Supported File Types for WildFire Analysis

Learn about the file type categories that Data Security supports for WildFire analysis.
Data Security supports the file type categories listed below for WildFire analysis. Data Security sends files to WildFire to scan for malware. For the supported categories listed below, Data Security supports all WildFire file types.
The following table lists the supported file categories. The example file types don't represent a complete list—rather, commonly used formats: this list changes as the underlying technology supports new file types. Use the examples to gauge the scope of the file categories.

File Type Support for WildFire Analysis

File Type Category
WildFire Analysis Support
Example File Types
Android application package
apk, ETC.
Adobe Flash
.swf, ETC.
Java Archive
jar, ETC.
Microsoft Office
docx, xlsx, pptx, ooxml, ETC.
Portable Executable
pe, exe, ETC.
Portable Document Format
pdf, ETC.
Mac OS X
dmg, pkg, ETC.
Archive
rar, 7z, ETC.
Linux
elf, ETC.
Script
bat, js, vbs, ps1, ETC.

Supported SaaS Applications with Selective Scanning

Learn about the cloud apps and asset types that are supported with group-based selective scanning.
Group-based selective scanning is available on the following cloud apps. Not all cloud apps are conducive to selective scanning. A cloud app must integrate with Azure Active Directory Services or other Identity Providers (through Cloud Identity Engine) and must enforce file ownership. Many cloud apps are designed to share files with multiple owners, so they don’t have the necessary characteristics to work in a selective scanning framework.
If you want similar results for Google Drive, use OU scanning.
Cloud AppSelective Scanning SupportedNotes
Box
Yes
Microsoft Office 365 — OneDrive
Yes
Google Drive
Yes
OU Scanning

Supported Languages for Scanning Assets

This section lists the different languages that Data Security supports when scanning assets.
Data Security can scan content in the following languages to detect and prevent data exposure:
  • English
  • German
  • Japanese
  • Spanish
  • Italian
  • French
  • Dutch
  • Portuguese