Patient Zero policy Realtime Policy has anyone actually done this?

Hello @wilson,

The patient 0 feature has two components that you reference.  The first is flagging the file if it's the first time it's been sandboxed and flagged as malicious.  In this case, the file is allowed to be downloaded and flagged after sandboxing is complete.   The second, optional component is the ability to hold the file until sandboxing is complete.    

The purpose of the second policy is to be a targeted protection for higher risk files and should be used in conjunction with other policies to provide layered defense.  In the screenshot provided the policy is scoped to file types across all categories (including Adult Content).  Ideally, administrators would have policies that would block the initial browse and access to Adult Content before a file download is ever attempted.  So a potential policy structure could be:

1.   Block all prohibited categories including Adult Content, Security Risk, etc 

2.   Block known malware uploads and downloads across all categories with Patient 0 hold policy

3.  Other activity, DLP, etc controls

This reason for having all categories selected in the malware policy is more of a safety net in case of newly observed sites (depending on your other policies), miscategorization, policy mistakes, etc.  In such a case, users would not be allowed to access adult content sites at all but if they somehow got the download link directly, it would be scanned for malware and then blocked after hitting the block all policy.  Keep in mind, these are suggested policies and you can change the order to essentially block any download first whether it contains malware or not but functionally they operate the same.  

As for the not holding it, Netskope does not store customer files for threat protection, DLP forensics, or any other reason.   In some cases, we may send the file to a third party repository that you own such as for DLP forensics.  

Can you elaborate a bit more on "Also, in practice, if you the download just fails for 10 minutes of clicking on it, no pop-up warning you that it is in review."  Why would the download fail?  I apologize if I'm misunderstanding the question here.