SaaS apps: origin (Preview)

To enable this Preview feature, contact Fortinet Support.

The origin-tracking SaaS apps parameter, available in the File origin parameters or Attachment origin parameters template sections, enables you to set conditions for triggering detections considering a file's web app origin. This parameter lets you define a list of protected web apps, from which downloaded files are monitored to prevent exfiltration.

The SaaS apps parameter integrates with the FortiDLP Console's SaaS apps module. For this reason, it is recommended that you set up your app inventory before configuring policies. For guidance on this, refer to SaaS apps in the FortiDLP Console User Guide.

There are three ways to configure the SaaS apps parameter

• Match SaaS apps by condition: This method allows you to define the categories, verdicts, and/or a minimum and maximum risk score to match web apps. If multiple conditions are specified, a SaaS app will match if it has at least one of the defined values for each configured parameter.

For example, to configure policy templates to monitor files downloaded from sanctioned apps, you could provide a condition configuration that includes the Sanctioned verdict. Further, if your condition configuration includes the File sharing and storage and Google Apps categories and the Sanctioned verdict, apps in either category that are sanctioned will match.

• Match SaaS apps from inventory: This method allows you to choose web apps from your SaaS app inventory.

For example, instead of defining categories and a verdict to match apps, you could select specific apps like Google Drive from your inventory.

• Use SaaS app specifier policy assets: This method allows you to use custom SaaS app specifier assets. These assets can be created by defining app conditions and/or selecting apps from your inventory like the above methods. However, SaaS app specifiers can be reused across policies.

For example, you might create a SaaS app specifier comprising a list of apps, from which downloaded files are monitored, that you use when configuring various templates.

For instructions on creating SaaS app specifiers, refer to Creating custom assets in the FortiDLP Administration Guide.

These three configuration methods can be used in conjunction within a single template, in which case OR logic will apply. That is, a SaaS app will match if it meets the criteria for either the condition configuration, the inventory configuration, or the policy asset configuration.

Some policy templates can be configured to generate detections considering a file's SaaS app origin and destination.

For example, using the Sensitive file uploaded template, you could create a policy to prevent sensitive files that are stored on a corporate Google Drive from being uploaded to any web app as follows. In the Website parameters section: Leave the SaaS apps parameter empty. This will raise a detection upon attempted uploads to any web app. Additionally, if upload blocking is enabled, all uploads will be blocked. In the File origin parameters section: For the SaaS apps parameter: In the Match SaaS apps by inventory section, click Add apps. In the Add SaaS applications dialog box, select the Google Drive checkbox and then click Add apps. In the SaaS apps dialog box, click Done. The parameter in the template editor will look as follows.