Configure Policy Settings Notifications

DLP Incidents

To prevent users from being overwhelmed with email DLP incident notifications, you can enable an Email Summary with an Incident Summary Report, schedule the frequency of its delivery, and disable it if necessary. 

1. Go to Policy > Policy Settings. 
2. Select the Notifications tab. 
3. Toggle Send Incident Summary ON to enable the email summary of DLP Incidents. Toggle OFF to disable the email summary. 
4. Select Frequency to send the email summary either Daily, Weekly, Bi-Weekly, or Monthly. 
5. Select a Saved View to send the list of incidents represented in it to users. Customize the list of incidents by selecting relevant incident types and a time frame for the incident summary. 
6. For Optional Recipients, enter a comma-separated list of recipients for every email summary of DLP Incidents.

7. Click Save. 

Slack Notifications

In Slack, by default, when a user uploads content that violates a DLP policy with a Quarantine or Delete response action, that user is notified through a Slack bot user registered by Skyhigh CASB. This bot is also used to send all other types of notifications in Slack, including incident notifications to the admin. 

The default Slack bot user name for Skyhigh CASB is securityadmin, but you can customize the Bot User Name if you like. 

For more information, see Link a Slack Notification to a DLP Policy.