Customized Policy
FortiCASB allows you to create personalized policies to suit your organization needs.
To add a custom policy, go to Threat Protection > Customized and click Add.
Custom policies focus on two aspects, content monitoring and activity monitoring. Content monitoring is primarily used to monitor files for sensitive data. Activity monitoring is primarily used to monitor users and user activities.
The following examples illustrate how to create some common custom policies.
Example 1: To monitor all downloads of a public link containing sensitive data
To receive an alert whenever a file containing sensitive data is downloaded from a public link, use the Exposure setting along with the Data Pattern setting. For example, to monitor a Salesforce link containing a social security number:
- Go to the Content tab.
- Select Specific Data Patterns, on the right.
- Click the box labeled Data Pattern, then select DLP SSN.
- Click the box labeled Exposure, then select SALESFORCE_LINK.
- Go to the Activity tab.
- Select Specific Events, on the right.
- Click the box labeled Event, then select Download File.
- Configure any other settings as needed.
Example 2: To monitor all activities of a group of users
To receive an alert whenever a specific user or group of users performs any action, use the User setting. For example, to monitor a group of users:
- Go to the Activity tab.
- Select Specific Users, on the right.
- Click the box labeled User, then select users to monitor. Alternatively, check the Exclude box on the right to monitor all users besides the ones selected.
- Configure any other settings as needed.