Employee Flight Risk Dashboard

  • 5 April 2024
  • 4 replies
  • 466 views
Employee Flight Risk Dashboard
Userlevel 2
Badge +12
  • Netskope Employee
  • 6 replies

Here is an Advanced Analytics dashboard that predicts when employees are planning to leave the company. Multiple signals are used to make the prediction including:

- Visits to career sites
- Visits to competitor job sites
- Uploads of resume data to webmail
- Suspicious data movement from corporate to unsanctioned apps
- Bulk downloads of data to corporate apps

To fill in this dashboard the following config will need to be in place:
1. Policy to alert when visiting (all activities) with destination ‘Job Search/Career’ category
2. Policy to alert when visiting (all activities) with destination a custom web category that includes competitor job sites
3. DLP policy to alert when resume data is uploaded to webmail category (use ML classifier for resume)
4. UEBA policy and config for suspicious data movement (need to identify corporate apps)
5. UEBA policy to detect bulk downloads of data

Thanks to @Aaron_Zhang for helping to build out the dashboard components.

 


 


4 replies

Userlevel 4
Badge +17

Thank you @bob  for consistently providing insightful content to the Netskope Community Members. ✨

Badge

Thank you very much for this!  One question - how do I find the ML classifier for resume in the DLP policy?  I do not see it as a predefined profile to add after setting the category and activities.

Userlevel 2
Badge +12

Hi @sfaeder,

If you have Advanced DLP you should have 26 ML classifiers include resume.  You can check by doing the following in your Netskope tenant:

  1. Policies > DLP > New Profile and click on NEXT
  2. In File Classifier box you should see Resume listed under HR.  Select it and click on NEXT and name and save the profile

 

If you do not have an Advanced DLP license I recommend creating a regular expression to look for keywords such as “resume’,  ‘CV’.

Badge

Fantastic!  Thank you again!  I really appreciate you breaking it down.

Reply