Skip to main content
McAfee MVISION Cloud

What's New in 2.9

What’s New in Skyhigh for Shadow IT

User Creation API

MVISION Cloud Cloud Access Security Broker (CASB) administrators can now bulk create CASB users through an API. Administrators can send requests containing user information (such as user email address or temporary password) and administrative flags (such as User is allowed to deobfuscate or User is Security Admin) to create users.

Reports – CSV Format Support

Users can now export reports created by Report Manager in CSV format along with the existing PDF, HTML, and Excel format options.

Date Picker Enhancement

The date picker calendar on the dashboard has been enhanced so that your selection options reflect the current data resolution (Day, Week, or Month). When you are in the Day view, individual days are selectable. When you are in the Week view, weeks are selectable (Sunday - Saturday). When you are in the Month view, months are selectable (1st - End of Month). Date ranges that are available for selection are highlighted in blue.

Threshold Tuning for Anomalies

Anomalies involving MIME Type and Service Category Based Data Transfer now offer Threshold Tuning. This will allow users to adjust the anomaly sensitivity for these anomaly types to control the number of anomalies generated.

New User Roles

Administrators can assign a role to a user to restrict access to certain parts of the MVISION Cloud Cloud Security Access Broker (CASB). These roles have been updated to allow for more granular access control:

  • Customer Administrator (formerly the Tenant role): This role has access to both the MVISION Cloud CASB Dashboard and the Enterprise Connector Console
  • Dashboard User: This role has access to the MVISION Cloud CASB Console and only and cannot login into the Enterprise Connector Console
  • Enterprise Connector User (formerly the Log Processor role): This role has access to the Enterprise Connector Console only and cannot login into the MVISION Cloud CASB Dashboard

Improved Service Group Assignment

In 2.9, services are restricted to a single service group only and conflicts are resolved through a workflow so that users can manage the process of deciding what group a service belongs to. For service groups that are generated automatically using inclusion criteria, an “exceptions” field is available to prevent unwanted services from being assigned to that group automatically.

Skyhigh Forward Proxy (Beta)

The MVISION Cloud Forward Proxy allows users to apply Data Loss Prevention policies against Shadow cloud services. MVISION Cloud supports multiple options to forward traffic to MVISION Cloud’s Forward Proxy and offers the ability to monitor or block data uploads that are in violation of defined DLP policies.

Cloud Registry Enhancements

The “Service Location” registry attribute now displays the specific geographic location for the headquarters of selected cloud service. This registry attribute is distinct from the Provider Location registry attribute which lists the location of the cloud service’s servers.

What’s New in Skyhigh for Sanctioned IT

Compliance

Match Highlighting

MVISION Cloud now provides an option to enable Match Highlighting for policy violations. When a file includes content that violates a data loss prevention policy, incident response teams are able to view an excerpt of the document that contains the text matching the DLP rule. Some surrounding text is included with the highlighted matches to help identify false positives. This is an optional feature that requires customers to provision their own instance of an Amazon AWS S3 bucket to store matches. Please contact support@skyhighnetworks.com for more information about enabling this feature.

Policy Violation - Collaboration Improvements

The Policy Violation platform now displays enhanced information about external collaborations and shared links. The Details panel on the policy violation lists all external collaborators for files associated with the policy violation. Additionally, users can now manually modify collaborations or delete shared links for as remediation action.

API Access Page Enhancements

The API Access page now contains additional status information for your API-enabled Sanctioned services. This page provides statistics on the number of events received in the last hour, day, and week from the cloud service.

Custom Email Templates

The email notifications that are sent as part of Data Loss Prevention and Secure Collaboration policies can now be customized by customers. Customization options include the ability to insert variables that include key forms of metadata from a policy violation.

New Data Identifiers

Data Identifiers have been added for Ohio Driver’s License Numbers, Turkish Kimlik, Bitcoin Addresses, ICD-10 codes and International Securities Identification Numbers (ISIN).

Threat Protection

Threshold Tuning Improvements

When updating anomaly thresholds, users now have precise information on how many anomalies will be generated based on the new threshold. Users will see a count of how many new anomalies will be displayed, which types of anomalies will not be detected and which ones will. This information is displayed during the preview stage of threshold tuning.

Easier Investigative Drilldowns

Users can drilldown into the activities and data impacted by threats and anomalies with one click. With 2.9, incident responders can download CSVs illustrating the impact of the threat/anomaly. These CSVs list all the activities and data corresponding to the threat/anomaly.

Skyhigh for Slack

API-Based DLP Support

With v2.9, MVISION Cloud has expanded CSP coverage to Slack. With API-based deployment of MVISION Cloud for Slack, users can extend DLP policies to content in Slack. MVISION Cloud’s DLP rules can detect sensitive content uploaded to Slack and enforce remediation actions such as removal of public links or quarantine or delete documents and messages that match a DLP policy.

Proxy-Based DLP Support

With proxy-based deployment of MVISION Cloud for Slack, users can enforce DLP policies in real-time for browser-based access to Slack. MVISION Cloud’s DLP rules can detect sensitive content uploaded to Slack and enforce remediation actions such as blocking or encrypting documents and messages that match a DLP policy.

Proxy-Based Cloud Access Policy Support

With proxy-based deployment of MVISION Cloud for Slack, users can enforce access control policies for browser-based access to Slack. MVISION Cloud’s access control policies can allow or deny access to Slack based on device type (managed vs. unmanaged) and users (groups).

Skyhigh for O365

Searchable Symmetric Encryption Support (Beta)

With proxy-based deployment of MVISION Cloud for OneDrive, users can now encrypt sensitive content while maintaining search functionality using the Searchable Symmetric Encryption (SSE) cipher. Search terms entered while connected to the proxy are automatically encrypted to match the encrypted content in your O365 deployment. Users connected to the MVISION Cloud Secure Proxy will view search results in plaintext. This is a beta feature and may not be available to all users. To learn more about this feature, please contact Support@skyhighnetworks.com.

What’s New in Skyhigh Enterprise Connector

                  MVISION Cloud Enterprise Connector provides integration with on-premises infrastructure and applications such as firewall/proxy logs, SIEM, Active Directory, and key management systems.

Active-Active Deployment Mode

                  The new Active-Active Deployment option delivers horizontal scaling and high availability. With this feature, all ECs configured in Active-Active mode process logs in parallel, thereby providing the ability to increase overall performance by adding more ECs. This deployment mode also delivers high availability and keeps your logs processing even if one or more of your Enterprise Connectors experiences downtime.

Closed-Loop Remediation with Palo Alto Panorama

                  Customers can use the API-based integration with Palo Alto’s Panorama Network Security Management for Closed-Loop Remediation (CLR). With this release, Enterprise Connector can communicate with Panorama and publish URLs of specified cloud services into Custom URL Category for desired action (e.g. block these cloud services). Effectively, this feature extends the cloud visibility and risk to your existing Palo Alto firewall for policy enforcement.

Export to Common Event Format (CEF) File Format

                  MVISION Cloud-detected anomalies can now be exported in the popular CEF file format, for import into 3rd party systems such as SIEM. CEF file now joins MVISION Cloud Key-Value Pair and LEEF as available formats for export.

Enhanced Security for LDAP Connections

                   Enterprise Connector can now communicate with LDAP over SSL to populate data from Active Directory. 

  • Was this article helpful?