Assess New Incidents on Data Security
Table of Contents
Assess New Incidents on Data Security
Data Security
Learn how to assess new incidents on
Data Security
.Data Security
compiles a summary of incidents for you to view, assess, and address with
further investigation or closure. SaaS Security web interface displays all the
relevant information you need to assess the incident and understand the service’s
decision to create the incident. After the initial discovery and remediation
process, the same incidents don't display again.Data Security
compares all information it discovers against the enabled
data patterns and active policy rules, then identifies all violations
and exposures for every asset across all cloud apps. Finally, SaaS Security
does the following:- Assigns a unique numericIncident ID, which associates the asset with the rule violation.
- Displays match results for the specific rules that the sensitive content violated when the rule defines data patterns instead of data profiles.
- Sorts incidents bySeverityso you can assess them efficiently.
Support for
automated remediation capabilities varies by SaaS application.
- From theDashboard, view the summary of theIncident By Status, which displays:
- Open—Number of open violations.
- Resolved—Number of closed incidents .
- From theDashboard, select eitherView All Open Incidentsfrom the Open Incidents by Severity section orView all Incidentsfrom the Incidents by Status section.This opens the page.
- Get more information about specific incidents.
- ClickData Asset Nameto display summary data and match results for the specific rules that were violated.These match results operate on rules that define data patterns only—not data profiles. Therefore, Incident Details don't yet display match results for predefined rules, which use data profiles by default.
- ClickRequest Snippets.The snippet automatically displays if you recently clicked on this button and the cached data isn't expired.
- NavigateBy Confidence Levelto filter through the match results, starting with High Confidence.
- Observe Asset Details.
- Get a better understanding of the data behind the incident. InActions, depending on the asset type and cloud app:
- Open File.
- Download File
- Admin Quarantine
- User Quarantine
- Change Sharing
- Address the incidents.After you understand the incidents and the context around them, you can start to address incidents. If you have several incidents to resolve, you can configure Automatic Incident Remediation Options for most of the cloud apps. There are several ways to remediate an incident:
