Use the Policy Settings Notifications tab to set notification options related to DLP Incidents and Slack Notifications.
To prevent users from being overwhelmed with email DLP incident notifications, you can enable an Email Summary with an Incident Summary Report, schedule the frequency of its delivery, and disable it if necessary.
- Go to Policy > Policy Settings.
- Select the Notifications tab.
- Toggle Send Incident Summary ON to enable the email summary of DLP Incidents. Toggle OFF to disable the email summary.
- Select Frequency to send the email summary either Daily, Weekly, Bi-Weekly, or Monthly.
- Select a Saved View to send the list of incidents represented in it to users. Customize the list of incidents by selecting relevant incident types and a time frame for the incident summary.
- For Optional Recipients, enter a comma-separated list of recipients for every email summary of DLP Incidents.
NOTE: This can cause many emails to be sent to the recipients in this list.
- Click Save.
In Slack, by default, when a user uploads content that violates a DLP policy with a Quarantine or Delete response action, that user is notified through a Slack bot user registered by Skyhigh CASB. This bot is also used to send all other types of notifications in Slack, including incident notifications to the admin.
The default Slack bot user name for Skyhigh CASB is securityadmin, but you can customize the Bot User Name if you like.
For more information, see Link a Slack Notification to a DLP Policy.