SaaS Security Administrator's Guide
    : Supported Content, Remediation and Monitoring
    Focus
    Download PDF
    Focus
    1. Home
    2. SaaS Security
    3. SaaS Security Administrator's Guide
    4. Data Security
    5. Get Started with Data Security
    6. Support on Data Security
    7. Supported Content, Remediation and Monitoring
    Download PDF

    SaaS Security Administrator's Guide

    Supported Content, Remediation and Monitoring

    Table of Contents

    Supported Content, Remediation and Monitoring

    View the list of supported SaaS applications and their supported remediation options on
    Data Security
    .
    Before you add a cloud app to
    Data Security
    , learn about the scan, remediation, and monitoring features that
    Data Security
     supports for your cloud app. Usually when a remediation capability isn't supported, it’s due to the cloud app’s API. However, as a cloud app’s API changes often
    Data Security
     is able to expand support. Unless otherwise stated, forward scan includes new assets, deleted assets, and updated content on assets. Additionally, sometimes a feature isn't relevant to a cloud app’s paradigm (for example, the cloud app doesn’t have folders), and so the feature isn’t applicable.

    Content Support on
    Data Security

    Scan content support is different from remediation support.
    Data Security
     can scan content based on supported file types and supported languages, but within that remediation depends on the cloud app. Additionally,
    Data Security
     offers different types of scan methods based on the type of cloud app and not all exposure levels apply to some cloud apps. Additionally, unless otherwise stated, Forward Scan typically includes new assets, deleted assets, and content updates on assets.
    Cloud App
    Scan Content
    Scan Methods
    Notes
    Amazon S3
    Buckets, Files
    Yes
    Yes
    Multi-account
    Internal, External,Public
    —
    Amazon Web Services (AWS) Console
    AWS settings
    No
    Yes
    No
    n/a
    Data Security
     has deprecated support for the Amazon Web Services app. To continue monitoring your resources deployed on AWS, try Prisma Cloud.
    Bitbucket
    Commit files, Repository
    Yes
    Yes
    n/a
    Internal, Public
    By default, the backward scan limit is set to 1 year. If you wish to extend this limit to more than 1 year, contact SaaS Security Technical Support.
    Box
    Files, Folders
    Yes
    Yes
    Yes
    All
    —
    Cisco Webex Teams
    Rooms, Messages, Files
    Yes
    Yes
    No
    Internal, External, Public
    —
    Citrix ShareFile
    Files, Folders
    Yes
    Yes
    No
    All
    —
    Confluence
    Page content, Attachments, Comments
    Yes
    Yes
    No
    Internal, External,Public
    —
    Confluence Data Center
    Page content, Attachments, Comments
    Yes
    Yes
    No
    Internal, External, Company
    By default, the backward scan limit is set to 1 year. If you wish to extend this limit to more than 1 year, contact SaaS Security Technical Support.
    Dropbox - Individual Folder
    Files, Folders
    Yes
    Yes
    No
    All
    —
    Dropbox - Team Folder
    Files, Folders
    Yes
    Yes
    No
    All
    —
    GitHub
    Files, Folders
    Yes
    Yes
    No
    Internal, Public
    GitHub V2
    Files, Folders
    Yes
    Yes
    No
    Internal, Public
    Backward scanning is supported up to 1 year only.
    Gmail
    Email content, Attachments
    No
    Yes
    No
    Internal, External
    For internal emails, only attachments are scanned. For external emails, both email content and attachments are scanned.
    Google Cloud Platform (GCP)
    Projects, Buckets, Files
    Yes
    Yes
    Yes
    Internal, External,Public
    —
    Google Drive - My Drive
    Files, Folders
    Yes
    Yes
    Yes
    All
    Google Drive - Shared Drives
    Files, Folders
    Yes
    Yes
    Yes
    All
    Jira Data Center
    Issue Descriptions, Comments, Attachments, Projects
    No
    Yes
    n/a
    No
    Jira Cloud
    Issue Descriptions, Comments, Attachments, Projects
    Yes
    Yes
    n/a
    No
    By default, the backward scan limit is set to 1 year. If you wish to extend this limit to more than 1 year, contact SaaS Security Technical Support.
    Jive
    Questions, Discussions, Document, Ideas, Blogs, Files, Comments
    Yes
    Yes
    No
    All
    —
    Microsoft Azure
    Storage Accounts, Containers, Files
    Yes
    Yes
    Yes
    Internal, External,Public
    —
    Microsoft Exchange
    Email content, Attachments
    No
    Yes
    No
    Internal, External
    —
    Microsoft Office 365 - OneDrive
    Files, Folders
    Yes
    Yes
    Yes
    All
    —
    Microsoft Office 365 - SharePoint
    Files, Folders
    Yes
    Yes
    No
    All
    —
    Microsoft Teams
    Channel Messages, Direct Chats
    No
    Yes
    n/a
    Internal, External,Company
    Attachments are supported using Office 365.
    Due to new Microsoft licensing requirements, Microsoft Teams connector will work only for customers running the E5 licenses.
    Salesforce
    Files, Tables, Chatter body
    Yes
    Yes
    No
    All
    Backward or Forward scan: the service performs Backward scan until it reaches current time, then performs Forward scan.
    Content: While
    Data Security
     stores the metadata for all unstructured files, it stores structured file data selectively. For example, a Salesforce Chatter message has structured data and is stored only when the content in the message matches a defined data pattern but an attachment on Salesforce Chatter has unstructured data, so
    Data Security
     scans the attachment and stores the metadata.
    Secure Data Space
    Yes
    Yes
    Yes
    No
    All
    —
    ServiceNow
    Tables, Attachments
    Yes
    Yes
    No
    All
    —
    Slack Enterprise Grid
    Files, Messages
    Yes
    Yes
    No
    All
    —
    Slack Enterprise V2
    Files, Messages
    Yes
    Yes
    Yes
    All
    By default, the backward scan limit is set to 1 year. If you wish to extend this limit to more than 1 year, contact SaaS Security Technical Support.
    Slack Pro and Business
    Files, Messages in Public Channels
    No
    Yes
    No
    No
    Forward Scan: scans for new assets only—not deleted assets and content updates on assets.
    No Scan support for messages in Private channels and Direct messages.
    Yammer
    Threads, Attachments
    No
    No
    No
    All
    —
    Zendesk
    Files, Attachments
    No
    Yes
    n/a
    Internal, Public
    Forward Scan: scans for new assets only—not deleted assets and content updates on assets.
    Zoom
    Chats, Messages, Transcripts
    No
    Yes
    No
    None
    Scan support for messages including private and public channels and direct messages within Team Chat.
    Support for cloud-recorded, zoom meeting voice transcripts when related settings are enabled on Zoom.

    Remediation Support on
    Data Security

    The following table outlines support by remediation capability.
    • When an admin quarantine is supported, unless otherwise stated, all file actions within that quarantine are also supported, including
      Delete
       asset,
      Restore
       assets, and
      Download
       asset.
    • When admin quarantine is supported, the assets that you can quarantine and the quarantine actions (for example,
      Download
      ) that you can perform on them include all those that also have scan support, unless otherwise stated.
    • All cloud apps support basic incident management actions, including
      Send Admin Alert
       and
      Create Incident
      , unless otherwise stated.
    Remediation support is organized by remediation stage:

    Automatic Remediation of Incidents on
    Data Security

    The following automatic remediation of incidents is supported.
    Cloud App
    Incident Autoremediation
    Notes
    Asset Quarantine
    Change Sharing
    Remove Public Links
    (Files & Folders)
    Notifications
    User
    Admin
    Direct Link
    Inherited Link
    Notify File Owner
    Notify via Bot
    Amazon S3
    Yes
    Yes
    Only files
    Yes
    Yes
    No
    n/a
    —
    Amazon Web Services (AWS) Console
    (Support deprecated)
    No
    No
    Yes
    No
    No
    n/a
    —
    Bitbucket
    No
    No
    Yes
    Yes
    Yes
    Yes
    —
    Box
    Yes
    Yes
    Only files
    Yes
    Yes
    Yes
    n/a
    —
    Cisco Webex Teams
    No
    No
    No
    No
    Yes
    Yes
    Supports deletion of messages and files.
    Citrix ShareFile
    No
    Yes
    Only files
    Yes
    Yes
    Yes
    n/a
    —
    Confluence
    Yes
    Yes
    Only files
    Yes
    Yes
    Yes
    No
    —
    Confluence Data Center
    No
    Yes
    Only attachments
    No
    No
    No
    No
    —
    Dropbox - Individual Folder
    Yes
    Yes
    Only files
    Yes
    Yes
    Yes
    n/a
    —
    Dropbox - Team Folder
    n/a
    Yes
    Only files
    Yes
    Yes
    Yes
    n/a
    —
    GitHub
    No
    No
    No
    No
    No
    n/a
    —
    GitHub V2
    No
    No
    No
    Yes
    No
    n/a
    —
    Gmail
    No
    No
    No
    No
    No
    n/a
    —
    Google Cloud Platform (GCP)
    No
    Yes
    Only files
    Yes
    Yes
    Yes
    n/a
    —
    Google Drive - My Drive
    Yes
    Yes
    Yes
    Yes
    Yes
    n/a
    —
    Google Drive - Shared Drives
    n/a
    Yes
    Yes
    Yes
    n/a
    n/a
    —
    Jira Data Center
    No
    No
    No
    No
    Yes
    No
    —
    Jira Cloud
    Yes
    No
    No
    No
    Yes
    Yes
    —
    Jive
    No
    No
    Yes
    Yes
    Yes
    No
    —
    Microsoft Azure
    No
    Yes
    Only files
    Yes, Only Folders
    Yes, Only Folders
    No
    n/a
    —
    Microsoft Exchange
    No
    No
    No
    No
    No
    n/a
    —
    Microsoft Office 365 - OneDrive
    Yes
    Yes
    Only files
    Yes
    No
    Yes
    n/a
    Microsoft Office 365 - SharePoint
    No
    Yes
    Only files
    Yes
    No
    Yes
    n/a
    Microsoft Teams
    Yes
    No
    n/a
    n/a
    Yes
    n/a
    Quarantine for Attachments is supported using Office 365.
    Salesforce
    No
    No
    No
    No
    No
    n/a
    —
    ServiceNow
    No
    No
    No
    No
    No
    n/a
    —
    Slack Enterprise Grid
    No
    Yes
    Only files
    No
    No
    Yes
    Yes
    Notifications sent via Slack to the quarantine administrator and the asset owner.
    Slack Enterprise V2
    No
    No
    No
    No
    Yes
    Yes
    Notifications sent via Slack to the quarantine administrator and the asset owner.
    Slack Pro and Business
    No
    No
    No
    No
    No
    Yes
    Yammer
    No
    No
    No
    No
    No
    No
    —
    Zendesk
    No
    No
    No
    No
    No
    Yes
    —
    Zoom
    No
    No
    No
    No
    No
    No
    —

    Post-Remediation of Incidents on
    Data Security

    The following postremediation of incidents is supported.
    Post-Remediation
    Notes
    Cloud App
    Admin Quarantine Actions
    Delete
    Restore
    Download
    Amazon S3
    Yes
    Yes
    Yes
    —
    Amazon Web Services (AWS) Console
    (Support deprecated)
    No
    No
    No
    —
    Bitbucket
    No
    No
    No
    —
    Box
    Yes
    Yes
    Yes
    —
    Cisco Webex Teams
    No
    No
    No
    Supports deletion of messages and files.
    Citrix ShareFile
    Yes
    Yes
    Yes
    —
    Confluence
    Yes
    Yes
    Yes
    —
    Confluence Data Center
    Yes
    Yes
    Yes
    —
    Dropbox - Individual Folder
    Yes
    Yes
    Yes
    —
    Dropbox - Team Folder
    Yes
    Yes
    Yes
    —
    GitHub
    No
    No
    No
    —
    GitHub V2
    No
    No
    No
    —
    Gmail
    No
    No
    No
    —
    Google Cloud Platform (GCP)
    Yes
    Yes
    Yes
    —
    Google Drive - My Drive
    Yes
    Yes
    Yes
    When a file is restored from Admin Quarantine, collaborators are not restored.
    Google Drive - Shared Drives
    Yes
    Yes
    Yes
    When a file is restored from Admin Quarantine, collaborators are not restored.
    Jira Data Center
    No
    No
    No
    —
    Jira Cloud
    No
    No
    Yes
    —
    Jive
    No
    No
    No
    —
    Microsoft Azure
    Yes
    Yes
    Yes
    —
    Microsoft Exchange
    No
    No
    No
    —
    Microsoft Office 365 - OneDrive
    Yes
    Yes
    Yes
    Microsoft Office 365 - SharePoint
    Yes
    Yes
    Yes
    Microsoft Teams
    None supported for supported scan content
    Quarantine for Attachments are supported using Office 365.
    Salesforce
    No
    No
    No
    —
    ServiceNow
    No
    No
    No
    —
    Slack Enterprise Grid
    All supported scan content, except Messages
    —
    Slack Enterprise V2
    No
    No
    No
    —
    Slack Pro and Business
    No
    No
    No
    —
    Yammer
    No
    No
    No
    —
    Zendesk
    No
    No
    No
    —
    Zoom
    No
    No
    No
    —

    Violation Management Support on
    Data Security

    Specific SaaS apps provide for violation management of data violations:

    Data Violations Support on
    Data Security

    The ability to display data violations and other related data depends on the SaaS app. Unless otherwise stated, data violations account for all supported content for a given SaaS app.
    Cloud App
    Data Violations (Explore > Data Violations)
    Bitbucket
    Yes
    Jira Data Center
    Yes
    Jira Cloud
    Yes
    Microsoft Teams
    Yes
    Slack Enterprise V2
    Yes
    Slack Pro and Business
    Yes

    Violation Actions Support on
    Data Security

    Supported violation management actions depend on the SaaS app and whether you’re an administrator or asset owner.
    Cloud App
    Violation Management
    Violation Management
    End-user
    Admin
    Open
    Resolved
    Ignored
    Delete
    ***
    View
    Not a Violation
    Delete
    View Dashboard
    Bitbucket
    Yes
    Yes
    Yes
    Yes
    Yes
    Yes
    No
    Yes
    Jira Data Center
    Yes
    Yes
    Yes
    Yes
    No
    No
    No
    No
    Jira Cloud
    Yes
    Yes
    Yes
    Yes
    Yes
    Yes
    No
    Yes
    Microsoft Teams
    Yes
    Yes
    Yes
    Yes
    Yes
    Yes
    No
    Yes
    Slack Enterprise V2
    Yes
    Yes
    Yes
    Yes
    Yes
    No
    No
    Yes
    Slack Pro and Business
    Yes
    Yes
    Yes
    Yes
    Yes
    Yes
    Yes
    Yes
    Zendesk
    Yes
    Yes
    Yes
    Yes
    Yes
    Yes
    No
    Yes
    Zoom
    Yes
    Yes
    Yes
    Yes
    Yes
    Yes
    No
    Yes
    ***
    Administrator can
    Delete
     the record for the data violation. End users can
    Delete
     the asset.

    User Activity Support on
    Data Security

    Cloud App
    Activity Monitoring (Explore > Activities)
    Activity Alerting (Policy > User Activity Rules)
    Folder Monitoring (Explore > Assets > Events within a Folder)
    Notes
    Amazon S3
    Yes
    Yes
    No
    —
    Amazon Web Services (AWS) Console
    (Support deprecated)
    No
    Yes
    No
    —
    Bitbucket
    Yes
    Yes
    No
    —
    Box
    Yes
    Yes
    Yes
    —
    Cisco Webex Teams
    No
    No
    No
    —
    Citrix ShareFile
    Yes
    Yes
    No
    —
    Confluence
    Yes
    Yes
    No
    —
    Confluence Data Center
    Yes
    No
    No
    —
    Dropbox - Individual Folder
    Yes
    Yes
    Yes
    —
    Dropbox - Team Folder
    Yes
    Yes
    Yes
    —
    GitHub
    No
    No
    No
    —
    GitHub V2
    No
    No
    No
    —
    Gmail
    Yes
    Yes
    n/a
    —
    Google Cloud Platform (GCP)
    Yes
    Yes
    n/a
    —
    Google Drive - My Drive
    Yes
    Yes
    Yes
    —
    Google Drive - Shared Drives
    Yes
    Yes
    Yes
    —
    Jira Data Center
    No
    No
    n/a
    —
    Jira Cloud
    Yes
    Yes
    n/a
    —
    Jive
    Yes
    Yes
    No
    —
    Microsoft Azure
    Yes
    Yes
    n/a
    —
    Microsoft Exchange
    Yes
    No
    n/a
    —
    Microsoft Office 365 - OneDrive
    Yes
    Yes
    No
    —
    Microsoft Office 365 - SharePoint
    Yes
    Yes
    No
    —
    Microsoft Teams
    Yes
    No
    n/a
    —
    Salesforce
    Yes
    Yes
    n/a
    —
    Secure Data Space
    Yes
    Yes
    n/a
    —
    ServiceNow
    Yes
    Yes
    n/a
    —
    Slack Enterprise Grid
    No
    No
    n/a
    —
    Slack Enterprise V2
    No
    No
    n/a
    —
    Slack Pro and Business
    No
    No
    No
    —
    Workday
    Yes
    Yes
    No
    —
    Yammer
    No
    No
    n/a
    —
    Zendesk
    No
    No
    No
    —
    Zoom
    No
    No
    No
    —

    Snippet Support on
    Data Security

    A snippet enables you to investigate a pattern match.
    Data Security
     supports snippets for most cloud apps. However, if
    Data Security
     does not support snippets for your cloud app or the specific asset type (file vs. chat), the
    Request Snippets
     button does not display in
    Matching Data Patterns
    .
    Data Security
    ’s ability to support snippets for your cloud app highly depends on the capabilities available in cloud app vendor’s public API.

    Recommended For You

    © 2024 Palo Alto Networks, Inc. All rights reserved.