Cortex XSOAR for Data Security
Table of Contents
Expand all | Collapse all
-
-
- What’s Data Security?
- Navigate To Data Security in Cloud Management Console
- Activate Data Security on the Hub
- Access Data Security for Standalone SaaS Security
-
- Allowed List of IP Addresses
-
- Begin Scanning an Amazon Web Services App
- Begin Scanning a Bitbucket Cloud App
- Begin Scanning a Box App
- Begin Scanning a Cisco Webex Teams App
- Begin Scanning a Citrix ShareFile App
- Begin Scanning a Confluence App
- Begin Scanning a Confluence Data Center App
- Begin Scanning a Dropbox App
- Begin Scanning a GitHub App
- Begin Scanning a GitHub V2 App
- Begin Scanning a Gmail App
- Begin Scanning a Google Cloud Storage App
- Begin Scanning a Google Drive App
- Begin Scanning a Jira Cloud App
- Begin Scanning a Jira Data Center App
- Begin Scanning a Microsoft Azure Storage App
- Begin Scanning a Microsoft Exchange App
- Begin Scanning Microsoft Office 365 Apps
- Begin Scanning a Microsoft Teams App
- Begin Scanning a Salesforce App
- Begin Scanning a ServiceNow App
- Begin Scanning a Slack for Enterprise Grid App
- Begin Scanning a Slack Enterprise App
- Begin Scanning a Slack for Pro and Business App
- Begin Scanning a Workday App (Beta)
- Begin Scanning a Yammer App
- Begin Scanning a Zendesk App
- Begin Scanning a Zoom App
- Reauthenticate to a Cloud App
- Verify Permissions on Cloud Apps
- Start Scanning a Cloud App
- Stop Scanning a Cloud App
- Rescan a Managed Cloud App
- Delete Cloud Apps Managed by Data Security
- API Throttling
- Configure Classification Labels
-
-
-
- SaaS Security with Enterprise DLP
- Predefined Data Patterns on Data Security
- Proximity Keywords
- Confidence Levels
- Shared Data Profiles and Data Patterns
- Modify a Predefined Data Pattern
- Create a Custom Data Profile
- Add a File Property Data Pattern
- Create a Custom Data Pattern
- Use Exact Data Matching (EDM)
- Enable or Disable a Machine Learning Data Pattern
- Configure WildFire Analysis
- Configure Regular Expressions
- Enable or Disable a Data Pattern
- View and Filter Data Pattern Match Results
-
-
-
- What is an Incident?
- Assess New Incidents on Data Security
- View Asset Details
- Filter Incidents
- Security Controls Incident Details
- Track Down Threats with WildFire Report
- Track Down Threats with AutoFocus
- Customize the Incident Categories
- Close Incidents
- Download Assets for Incidents
- View Asset Snippets for Incidents
- Analyze Inherited Exposure
- Email Asset Owners
- Modify Incident Status
-
- What is a Data Violation?
- Assess New Data Violations on Data Security
- Configure Data Violation Alerts on Data Security
- Filter Data Violations on Data Security
- View Asset Snippets for Data Violations on Data Security
- View Data Violation Metrics on Data Security
- Modify Data Violation Status on Data Security
-
-
-
-
- What’s SaaS Security Inline?
- Navigate To SaaS Security Inline
- SaaS Visibility for NGFW
- SaaS Visibility and Controls for NGFW
- SaaS Visibility for Prisma Access
- SaaS Visibility and Controls for Panorama Managed Prisma Access
- SaaS Visibility and Controls for Cloud Managed Prisma Access
- Activate SaaS Security Inline for NGFW
- Activate SaaS Security Inline for VM-Series Firewalls with Software NGFW Credits
- Activate SaaS Security Inline for Prisma Access
- Connect SaaS Security Inline and Cortex Data Lake
- Integrate with Azure Active Directory
-
-
- SaaS Policy Rule Recommendations
- App-ID Cloud Engine
- Guidelines for SaaS Policy Rule Recommendations
- Predefined SaaS Policy Rule Recommendations
- Apply Predefined SaaS Policy Rule Recommendations
- Create SaaS Policy Rule Recommendations
- Delete SaaS Policy Rule Recommendations
- Enable SaaS Policy Rule Recommendations
- Modify Active SaaS Policy Rule Recommendations
- Monitor SaaS Policy Rule Recommendations
-
- Enable Automatic Updates for SaaS Policy Rule Recommendations on Cloud Managed Prisma Access
- Import New SaaS Policy Rule Recommendations on Cloud Managed Prisma Access
- Update Imported SaaS Policy Rule Recommendations on Cloud Managed Prisma Access
- Remove Deleted SaaS Policy Rule Recommendations on Cloud Managed Prisma Access
- Manage Enforcement of Rule Recommendations on NGFW
- Manage Enforcement of Rule Recommendations on Panorama Managed Prisma Access
- Change Risk Score for Discovered SaaS Apps
-
-
-
-
- Onboarding Overview for Supported SaaS Apps
- Onboard an Aha.io App to SSPM
- Onboard an Alteryx Designer Cloud App to SSPM
- Onboard an Aptible App to SSPM
- Onboard an ArcGIS App to SSPM
- Onboard an Articulate Global App to SSPM
- Onboard an Atlassian App to SSPM
- Onboard a BambooHR App to SSPM
- Onboard a Basecamp App to SSPM
- Onboard a Bitbucket App to SSPM
- Onboard a BlueJeans App to SSPM
- Onboard a Box App to SSPM
- Onboard a Bright Security App to SSPM
- Onboard a Celonis App to SSPM
- Onboard a Cisco Meraki App to SSPM
- Onboard a ClickUp App to SSPM
- Onboard a Confluence App to SSPM
- Onboard a Contentful App to SSPM
- Onboard a Convo App to SSPM
- Onboard a Couchbase App to SSPM
- Onboard a Coveo App to SSPM
- Onboard a Crowdin Enterprise App to SSPM
- Onboard a Customer.io App to SSPM
- Onboard a Databricks App to SSPM
- Onboard a Datadog App to SSPM
- Onboard a DocHub App to SSPM
- Onboard a DocuSign App to SSPM
- Onboard a Dropbox Business App to SSPM
- Onboard an Envoy App to SSPM
- Onboard an Expiration Reminder App to SSPM
- Onboard a Gainsight PX App to SSPM
- Onboard a GitHub Enterprise App to SSPM
- Onboard a GitLab App to SSPM
- Onboard a Google Analytics App to SSPM
- Onboard a Google Workspace App to SSPM
- Onboard a GoTo Meeting App to SSPM
- Onboard a Grammarly App to SSPM
- Onboard a Harness App to SSPM
- Onboard a Hellonext App to SSPM
- Onboard an IDrive App to SSPM
- Onboard an Intercom App to SSPM
- Onboard a Jira App to SSPM
- Onboard a Kanbanize App to SSPM
- Onboard a Kanban Tool App to SSPM
- Onboard a Kustomer App to SSPM
- Onboard a Lokalise App to SSPM
- Onboard a Microsoft Azure AD App to SSPM
- Onboard a Microsoft Exchange App to SSPM
- Onboard a Microsoft OneDrive App to SSPM
- Onboard a Microsoft Outlook App to SSPM
- Onboard a Microsoft Power BI App to SSPM
- Onboard a Microsoft SharePoint App to SSPM
- Onboard a Microsoft Teams App to SSPM
- Onboard a Miro App to SSPM
- Onboard a monday.com App to SSPM
- Onboard a MongoDB Atlas App to SSPM
- Onboard a MuleSoft App to SSPM
- Onboard a Mural App to SSPM
- Onboard an Office 365 App to SSPM
- Onboard Office 365 Productivity Apps to SSPM
- Onboard an Okta App to SSPM
- Onboard a PagerDuty App to SSPM
- Onboard a RingCentral App to SSPM
- Onboard a Salesforce App to SSPM
- Onboard an SAP Ariba App to SSPM
- Onboard a ServiceNow App to SSPM
- Onboard a Slack Enterprise App to SSPM
- Onboard a Snowflake App to SSPM
- Onboard a SparkPost App to SSPM
- Onboard a Tableau Cloud App to SSPM
- Onboard a Webex App to SSPM
- Onboard a Workday App to SSPM
- Onboard a Wrike App to SSPM
- Onboard a YouTrack App to SSPM
- Onboard a Zendesk App to SSPM
- Onboard a Zoom App to SSPM
- Onboarding an App Using Azure AD Credentials
- Onboarding an App Using Okta Credentials
- Delete SaaS Apps Managed by SSPM
Cortex XSOAR for Data Security
Data Security
Learn about how
Data Security
integrates with Cortex
XSOAR.Data Security
is now available on the Cortex
XSOAR Marketplace. With this SaaS Security integration, Cortex XSOAR collects incidents
from Data Security
for improved security orchestration and incident
management and remediation of risks posed by data exfiltration on
your organization’s Sanctioned SaaS applications.In addition to the incident management and incident lifecycle capabilities
that XSOAR offers, with the SaaS Security playbooks, you can take
actions on incidents just as you do now on SaaS Security web interface,
including:
- Close incidents on Cortex XSOAR using the same Closed states to which you’re accustomed.
- Remove public sharing (public links) on assets.
- Quarantine assets.
- Restore quarantined assets.
- Send email notifications to SaaS Security administrators to request remediation of incidents.
- Notify asset owners and provide remediation options to SaaS Security administrators to resolve incidents.
Get Started
Here’s how to get up and running with
Data Security
on Cortex XSOAR:- Install SaaS Security Content Pack and sample playbooks.
- Review the SaaS Security descriptionDetailson XSOAR Marketplace for the SaaS Security Content Pack and the documentation inContent>Playbooksto understand the benefits of this integration and what the SaaS Security Content Pack includes.Content Pack update notifications display automatically in Cortex XSOAR. Periodically check for these notifications and update the Content Pack to receive enhancements and fixes.
- Customize the sample SaaS Security playbooks:
- SelectPlaybooks.For each sample playbook, click on the Playbook Setting gear icon to display instructions on how to modify the playbook settings.
- (Recommended) Selectand specify if you want to enableSaaS Security - Take Action on the IncidentEditRemove Public SharingSaaS Security Remove Inherited Sharing.
- (Recommended) Selectand specify an administrator account.SaaS Security - Incident ProcessorPlaybook TriggeredPlaybook Inputs and OutputsIf an incident isUnassignedonData Security, XSOAR sends action requests to this backup administrator email address. Otherwise, XSOAR sends action requests to theAssignedadministrator. If you do not specify this backup administrator, any action requests forUnassignedincidents fail with the following indicators:
- Workflow fails onIncident Detail.
- Work plandisplays red instead of orange.
- Configure SaaS Security on Cortex XSOAR:
- Select, then click the Instance Settings gear icon for the SaaS Security Content Pack.SettingsIntegrationsServers & Services
- Observe theInstance Settingsthat you need to configure.provides instructions on how to create the Client ID and Client Secret with more detailed instructions in the SaaS Security Administrator’s Guide.SaaS SecurityInstance SettingsHelpData Securitysupports one syslog receiver or one API client app with access to log data. Delete the existing configuration before you add a new one. If you want to use both Splunk and Cortex XSOAR, directly connect Splunk to Cortex XSOAR using the Splunk integration, and create a Client ID and Client Secret for Cortex XSOAR to directly connect toData Security.When you enable SaaS Security Incident Mirroring, turn onIncoming and Outgoingand enableClose Mirrored XSOAR Incident.
- Wait while XSOAR populates with SaaS Security incidents.Completion time depends on the amount of incident data XSOAR needs to load. Also, the value you specified for theFetch Intervalsetting determines how frequently XSOAR loads new data.
- Investigate SaaS Security incidents on XSOAR:
- Selectand browse the metrics for newly discoveredDashboards & ReportsIncidentsSaaS Security Incidents.
- Select, then click theIncidentsTable ViewIncidentsIDto investigate the asset that triggered the incident.For a description of each column in the table, go to the Content Pack documentation and clickContentIncident Fields
- FromSummary View, select, thenNotesDownloadorViewthe asset for inspection.
- Manage and remediate SaaS Security Incidents on XSOAR:Before you assess, manage, or remediate incidents, learn about Incident Management on XSOAR. However, chances are you’re already using XSOAR to manage incidents for other applications and are familiar with XSOAR capabilities. In that case, consider the following management and remediation capabilities that are unique to SaaS Security on XSOAR.
- FromSummary View, select, then clickWork PlanSend Ask Question EmailandComplete task,Assign owner, orSet due dateto request that an administrator remediate an incident orCloseincidents that are not threats using the supported method.SaaS Security playbooks support the same Closed states that are available directly onData Security.
- FromSummary View, selectRemediation Action, then remediate the incidents by using the supported Run Commands or by clicking on theSaaS Security Remediation Typeactions.The remediation actions listed behave just as you’d expect if you performed the action directly on SaaS Security. If the action doesn’t display, it is not supported for the SaaS application on which the asset resides.
Close Incidents on XSOAR
When you
Close
an incident,
you must do so from the Summary View
, not Table
View
. An incident has both a unique ID
on
XSOAR and a unique SaaS Security Asset ID
on
XSOAR. Table View
controls the closing of
the XSOAR incident only and Summary View
closes
both the SaaS Security incident (SaaS Security State
)
and the XSOAR incident (State
), if you have
the recommended Close Mirrored XSOAR incident
setting
selected.