End User Remediation

To create or edit a sanctioned DLP policy:

1. In Skyhigh CASB go to Policy > DLP Policies.
2. Click Actions > Sanctioned Policy > Create New Policy. (See Create a Policy from a Template for information about templates.)
3. On the Description page, name the policy and describe its status and scope:
   • Name. Enter a descriptive name to help identify the policy.
     
   • Description. (Optional) Enter a description for your DLP Policy. 
   • Deployment Type. Select an integration method. Some user actions and response actions depend on the Type you choose. Choose from:
     • API
     • Lightning Link
     • Reverse Proxy
   • Services. Click Select Service Instances, then select the instances you want the policy to apply to from the list. For example, select OneDrive.
   • Click Done. 
   • Users. Click Edit to select one of the options for Users to Include in the policy.
     • All Users. Apply the policy to all users.  
     • Use a predefined dictionary. Apply the policy to users in a predefined dictionary. 
     • Manually enter users. Manually enter user emails in a list. Use a comma to separate email addresses. 
   • Click Save. 
   • Add Exclusions. Select any Users to Exclude from the policy.
     
     • None. Do not exclude any users from the policy. 
     • Use a predefined dictionary. Apply the policy to users in a predefined dictionary. 
     • Manually enter users. Manually enter user emails in a list. Use a comma to separate email addresses. 
   • Click Save. 
   • User Groups. If your tenant has User Data (Active Directory) configured, click Edit to select the User Groups to include in the policy. 
     
   • Click Done. 
   • Add Exclusions. Select any User Groups to exclude from the policy.
   • Click Done. 
4. Click Next. 
5. On the Rules & Exceptions page, enter the following information:
   1. Rules. Specify the rules that the policy enforces. You can specify one or more rules or rule groups. You can also delete the rule group. Deleting the rule group removes the included rules in that set.
      When the rule is defined, the rule group name is automatically generated. You can edit and provide a new name for each rule group.
      
      • Classification
      • Collaboration
      • Data Identifier
      • File Name
      • File Path/Folder ID
      • File Size
      • File Type
      • Keywords
      • Regular Expression
      • Structured Data Fingerprint
      • Unstructured Data Fingerprint
   2. Click AND to add another rule, if needed. 
   3. Click THEN to add a severity: Critical, Major, Minor, Warning, or Info. 
   4. For Create An Incident, from each option drop-down you can select:
      • Incident Status
      • Incident Owner
      • Resolution Action
6. Click New Rule Group to add more, if needed. 
7. Click Add Exception. Add one or more exceptions, if needed. A DLP policy ignores any exception group within the policy. An exception group is ignored when ALL exceptions within the group match.
8. Click Add Exception Group to add more. 
9. Click Next. 
10. On the Responses page:
    1. Responses. Select the response actions that are triggered when the policy rules are matched. By default, all DLP policies create an incident.
    2. Click AND to select a response action for the rule group.
       
    3. For Email Template, select Default End User Remediation.
    4. Click Done.
11. Click Next. 
12. Click Save. 

After you create or edit a DLP policy for End User Remediation, you can test the End User Remediation workflow.