Create Web DLP Policy for CAI

Prerequisites 

To create a Web DLP Policy for CAI using the Skyhigh CASB  DLP Policy wizard, your user account must have the following roles:

• DLP Policy Manager
• Web Policy Manager

Policy Wizard Rules 

To scope your policy, the DLP Policy wizard uses the following rules:

• AND/OR to refine the rule.
• Change IS to IS NOT to create exceptions.
• There is no THEN for scoping.
• Click Next when complete.

Create a Web DLP Policy for CAI

To create a Web DLP Policy for CAI using the Policy wizard:

1. Sign in to Skyhigh CASB and go to Policy > Web Policy > Policy. 
2. On the Web Policy tree, go to Data Protection (DLP) > Web DLP. 
3. Click the "+" icon to create a new Web DLP Policy.
   
4. On the Name & Scope wizard, configure the following information: 
   • Name. Enter a unique name for your policy. 
   • Description. Add an optional description for the policy. 
   • Scope. The policy is applied to all traffic by default. You can edit this to reduce the scope to specific traffic using any combination of the following criteria. 
     (For this example, click Service, and in the Search for Service pane, search for and select Microsoft Office 365 and OneDrive.) 
     • Client IP. The IP address of the endpoint. 
     • Connection IP. The IP address of the firewall or other device between your organization's network and the cloud. (Your public IP address.)
     • Location. Any location name configured in the UI for Web Policy. 
     • Service. The cloud service to which it applies. 
     • Service Group. The group that contains the cloud service to which it applies.
     • User Name. Name of the user making the web request.
     • User Group. Names of one or more groups where the user making the web request is a member.
     • URL/Domain/Host. The URL/Domain/Host name of the user making the web request.
     • Web Category. Category of the URL requested by the user.
       
5. Click AND or OR to add another criteria parameter. Otherwise, click Next. 
6. On the Rules wizard, set a condition for a rule that triggers a response if this condition matches. If this data is involved, the response is triggered. 

• Classification. Classification allows you to categorize files based on their confidentiality and enforce security policies associated with confidentiality levels. Click Select, then in the Select Classification pane, search for and select the Classification you want to use. (For this example, click Sensitive > Legal, Financial and Security Compliance, Confidential)
  • Skyhigh. Default Classifications are provided by Skyhigh Security. 
  • Custom. Create Custom Classifications. 
  • All Classifications. Displays all available Classifications. 
• Severity. Assign severity level for content matches. This determines the severity level of the incident. Click Then, then select the severity of the incident. (For this example, select Major.)
  • Critical
  • Major
  • Minor
  • Warning
  • Info
• Additional Responses. Select an optional response, if required. (For this example, select Block.)
  

7. Click Next. 
   
8. On the Review page, review the policy you have created. To make any edits, click Edit.
9. Click Save. 
   
10. Your policy is saved but still needs to be published to be enabled.
    • Keep Working. Click to continue editing. You are alerted by the shield icon in the Skyhigh CASB navigation bar when a Web Policy change is waiting to be published. 
    • Publish. Click to publish your policy. 
      
11. Your policy is published and enabled. Click OK. 
12. Your new Web Policy is displayed on the following pages: 
    • Policy > DLP Policies > DLP Policies
      
    • Policy > Web Policy > Policy
      

If any Web DLP policies are violated, you can view the incidents and apply the necessary remediation actions on the Incidents > Policy Incidents page. For details, see Shadow/Web DLP Incidents.