Match Criteria for Data Asset Policies
Table of Contents
Match Criteria for Data Asset Policies
Define the match criteria that a data asset policy uses when the service scans for
matches.
Define the match criteria that a data asset policy uses when the service scans for matches.
Match Criteria for a Data Asset Policy
When you add a new asset rule or you
modify a policy
rule, you define the match criteria that the data asset policy uses when
Data Security scans for matches. The service compares all of the
information it discovers against the enabled data asset policies and identifies
incidents and exposures in every asset across all your monitored SaaS applications.
Match criteria is critical for successful discovery of risks in SaaS application
usage across your organization so, when you set the match criteria, you must
carefully consider the thresholds, types of information, and risks associated with
how assets are shared. Use match criteria to enforce compliance with your corporate
acceptable use policy.
You can also use the Advanced tab to define the match criteria
using expressions. Use the tooltip at the right side of the field to learn about the
various advanced search queries.
The fields policy.name,
incident.category, email.sent,
and assigned.to in the Advanced
tab are:
- Applicable only when you perform an advanced search in the Data Assets page.
- Not applicable when you create a policy (using ).
Match Criteria | Description |
|---|---|
|
Activity
|
Select the asset access and modification activities within a
selected time frame to match. For example, activities can
include Accessed, Not
Accessed, Modified, and
Not Modified. Time frames include
in the past week, in the
past month, and in the past 6
months.
|
|
Asset Name
|
Enter the Asset Name to include or exclude
in the match results. Select either
Equals to match the asset, or
Does not Equal to exclude the asset
from matching.
|
|
Cloud Applications
|
Select the managed applications to scan and match. By default,
all cloud apps you added to Data Security are scanned,
but you can Rescan a Managed Cloud App.
|
|
Data Pattern
|
Select the available data patterns to match, including predefined
or custom data patterns or a file property you defined when you
create a custom data
pattern. Specify your include or exclude logic. Enter
the number of Occurrences and
Confidence (Confidence Level)
required to display a data pattern match.
|
|
Data Profiles
|
Select the available data profiles to match when you create a custom data
profile.
|
|
Exposure
|
Select the match conditions for how the asset is shared (Public,
External, Company, or Internal).
|
|
Label
|
Select the app (Google Drive) and the data label that you fetched
for that app.
For Microsoft Labels,
use custom DLP patterns as match criteria. |
|
Extension
|
Enter the File Extension to include or
exclude in the match results. Select either
Equals to match the asset file
extension, or Does not Equal to exclude
the asset file extension from matching.
|
|
File Hash (SHA256)
|
Files are scanned using WildFire analysis to detect and protect
against malicious portable executables (PEs) and known threats
based on file hash. Enter the Hash
(SHA256) details of the file to match. Select
Equals (include in matching), or
Does not Equal (exclude in
matching).
|
|
Owner
|
Enter the email address for the asset
Owner to
Include or
Exclude in the match results. You can
add one or more Directory groups
|
|
Owner Group
|
To enforce group-based policy using File Owner’s
Group, you must first Integrate
Cloud Identity Engine with Data Security.
Select either Equals, or Does
not Equal and the Identity Provider Group to
which the file owner must belong. You can also select
Not Available if you want to enforce
an action for any users who are not identified either because
the email address is unavailable or because they belong to an AD
group that is not being scanned by Data Security.
|
Trust State occurrence | When you Define
Untrusted Users and Domains or if you are matching on an
assets trust state, all assets shared with a user in the selected Trusted, Untrusted,
or Anyone Not Trusted users list are detected
as a match. Specify the number of occurrences (such as Any, More
than, Fewer than, or Between with
whom a file must be shared to trigger a match. |
