Netskope Global Technical Success (GTS)
DLP - Scan documents for a particular keyword
Netskope Cloud Version - 125
Objective
This article aims to detect all the downloaded/uploaded documents which contains a specific keyword
Prerequisite
SWG or Next-Gen SWG with Standard DLP
Context
A company would like to block all the upload activities related to files which contains the “confidential” keyword
Configuration
Step #1 - Define the DLP Entity
Path: Netskope Tenant UI >>> Policies >>> DLP >>> DLP Rules >>> Entities
Define a new entity to identify the “confidential” work like below:
| ℹ️ With the confidential regex we’re matching all the files containing the “confidential” string |
Step #2 - Define the DLP Rule
On the “Policies > Profiles > DLP > DLP Rules > Rules” menu define a new Rule
- Entity: Select the entity created at the Step #1 as shown above
- Exact match: No changes
- Advanced options: No changes
- Content: Metadata & Content
- Severity threshold: Set Threshold using Record, set the severity level and the “Take action at X severity” option
Step #3 - Define the DLP Profile
On the “Policies > Profiles > DLP” menu define a new DLP Profile with the DLP Rule created at the Step #2 as shown below
| ℹ️ Leave the “File Profiles” section empty unless you’d like to exclude some specific files |
Step #4 - Configure a Real-Time Protection Policy
On the “Policies > Real-Time Protection” menu define a new Real-Time Protection Policy with the DLP Profile just created
- Source: Select the users you’d like to apply the restriction or none to apply the restriction to any user
- Destination Category: “Cloud Storage” or any category you’d like to select
- Activities: “Upload”
- DLP Profile: Select the DLP Profile created on the Step #3
- Action: Block
- Template: Select the user notification template
| 💡Consider to add also the “Unsanctioned” CCI App tag on the above policy as shown below
|
Terms and Conditions
- All documented information undergoes testing and verification to ensure accuracy.
- In the future, it is possible that the application's functionality may be altered by the vendor. If any such changes are brought to our attention, we will promptly update the documentation to reflect them.
Notes
- This article is authored by Netskope Global Technical Success (GTS).
- For any further inquiries related to this article, please contact Netskope GTS by submitting a support case with 'Case Type – How To Questions'.
