When an end user violates a policy in OneDrive, a notification is generated based on the notification settings configured by you in the policy configurations.

This document explains where you can find notifications on policy violations and what actions can be taken.

Nightfall Violations Page

To view the Nightfall violations page:

1. Navigate to the Violations page in Nightfall.

2. Apply filters to view only OneDrive violations.

1. (Optional) To view historic alerts, set the date filter appropriately.

1. (Optional) Hover over a violation to view the severity of the violation (Likely, Very Likely). You can also check if a violation has active credentials.

1. Click on any Violation to view the details.

1. Click on any violation to view the exact data that caused the violation (highlighted in red). You can click Expand details to view further details.

For more information on Violations, see Violations.

Email Notifications

• If you have configured Email Notification in Admin Alerting, Nightfall admins receive the Email notification. This Email allows admins to take actions from within the Email.

• If you have configured Email Notification in the Automation section of End user notification settings, end users receive an email from Nightfall. This notification allows end users to take remedial actions from within the Email. The available remedial actions depend on the settings configured in the end user remediation section.

In this stage, you select the Integration for which the policy is created. In this case, Gmail integration must be selected.

1. Click Policies from the left menu.

2. Click + New Policy.

3. Select Sensitive Data.

1. The tile for OneDrive should state Connected if Directory Sync has been setup for the M365 tenant in addition to enabling the OneDrive application for the M365 tenant. Proceed to select the OneDrive integration.

DLP policies are a set of rules that include specific conditions, actions, and exceptions that monitor and filter data. DLP policies also enable you to remediate any leakage of sensitive information from within your organization.

• You can set up policies to scan data that is sent through some or all applications within your organization.

• You can configure policies and choose to not apply them all the time.

Before you define a policy or a set of policies, we recommend that you define the objectives of each policy, which can then be fulfilled when you configure the policy.

Here are a few important questions to ask before configuring your policies:

• What data do you plan to monitor?

• Where within the organization do you want to monitor?

• What should be the scope of each policy?

• What conditions must apply for the policy to match?

• What exceptions/exclusions can be allowed?

• What remediation actions should the policy take?

You can now configure policies on the GitHub integration to determine which repositories are monitored, and which ones are excluded from monitoring. You can also automate the remediation actions that you want Nightfall to perform on a policy violation.

Creating Policies in Nightfall for GitHub

The process of creating policies in Nightfall consists of six stages enlisted as follows.

Integration

Scope

Detection Rules

Advanced Settings

Creating Policy

Managing Violations

In this section, you can select the Detection rules for the policy and If not already created, you can create detection rules. To learn more about how to configure detection rules, see Configuring Detection Rules.

You can use the search bar to search for a detection rule by its name.

Once the required detection rules are displayed, you can select the required detection rules by ticking the respective check box. When you select any detection rule, you can view three options.

These three options are related to the display of detection rules.

• All Detection Rules: This option displays all the available detection rules, irrespective of the detection rule(s) selected.

• Selected Detection Rules: This option displays only those detection rules that you have selected.

• Unselected Detection Rules: This option displays only those detection rules that you have not selected.

Select the check box(es) of all the detection rules you wish to include in the policy. The policy evaluates only those detection rules that you have selected here. Once you select all the required detection rules, click Next to move to the next stage.

In this stage, you must select the tenant and the files of your OneDrive that must be monitored.

To configure Scope, click + Add Tenant and select a tenant.

Configuring the Inclusion Section

Once you select the tenant, you must select which Teams and Channels if the selected tenant, must be monitored by Nightfall. This selection can be done in the Include in monitoring section.

Selecting All Drives

To monitor all the drives in your OneDrive, you must select the All OneDrives option.

Configuring the Inclusion Section

Scan Documents with Permissions

Within your drives, files have different types of permission sets. Nightfall allows you to select files with specific permission types to be monitored. You can select the respective check box to monitor files with specific permission sets. To monitor all the files, irrespective of the permission, select Access for all.

Include Special Folders

In this section, you can select the special folders to be monitored. You can select the check box for the respective special folder to include it in monitoring. To select all the special folders, click Select All.

Selecting Specific Drives

To monitor drives specific to a user or group, you must select the Selected OneDrives option.

Select the drives of the users and groups that must be monitored.

The #scan-documents-with-permissions and the #include-special-folders configurations are the same as in case of #selecting-all-drives.

Configuring the Exclusion Section

When you select the All OneDrives option, all the files and folders in your OneDrive are selected for monitoring. However, you can configure the exclusion section to skip some files and folders from being monitored. The exclusion section is optional and you can skip it if you wish to monitor all the drives. The exclusion section is not applicable if you select the Selected OneDrives option in the Inclusion section.

Nightfall provides you four options to configure the exclusion option.

Exclude by OneDrives

In this option, you can directly select the individual or group OneDrives to be excluded from being scanned.

Excluding By Label

In this option, you can select the labels to be excluded from being monitored. This option is in Beta because the Microsoft API used in this option is itself in Beta.

Exclude by Folder Paths

In this option, you can enter the folder pths to be excluded. All the files and folders in the folder path are excluded from being scanned. The folder paths must be relative to the base of OneDrive.

Exclude by File Extensions

In this option, you can select the file extensions. All the files with the selected extension are excluded from being scanned.

In this final stage, you assign a name to the policy, verify your configurations, and create the policy.

1. Enter a name for the policy.

2. (Optional) Enter a description for the policy.

3. Click Next.

1. Verify if all the policy configurations are set up as per your requirements.

2. (Optional) Click back or click on any specific stage to modify any of the policy configurations.

3. Click Save Changes.

This stage allows you to select notification channels if a policy violation occurs. The notification alerts are sent at two levels.

Admin Alerting

This section allows you to send notifications to Nightfall users. The various alert methods are as follows. You must first turn on the toggle switch to use an alert method.

The steps to configure alert channels for policy-level integration are the same as in the case of integration-level alerts. You can refer to this document for steps.

Automated Actions

Automated actions allow you to configure automated remediation actions when sensitive data is found in an Email. Nightfall supports two automated actions for OneDrive DLP.

• Restrict to Owner: This action suspends the current file permissions and restricts the access of the file only to its owner.

• Delete Document: The action permanently deletes the file from OneDrive.

• Move to Recycle Bin: This action deletes the file from OneDrive. Users can recover the file from OneDrive's recycle bin.

To enable the automated actions you must turn on the respective toggle switch.

You can also set the timeframe as to when an automated action must be implemented. You can choose to implement the action immediately after discovering sensitive data or after some time has elapsed.

End-User Notification

This section allows you to configure notifications to be sent to the end user whose actions triggered the violation.

Custom Message

Enter a custom message to be sent to the end user. This message is sent in an Email. You can modify the default message provided by Nightfall and draft your message. The total character length allowed is 1000 characters. You can also add hyperlinks in the custom message. The syntax is <link | text >. For example, to hyperlink www.nightfall.ai with the text Nightfall website, you must write <www.nightfall.ai|Nightfall website>.

Automation

The automation settings allow you to send notifications to end users. You can select one or both the notification methods. You must first turn on the toggle switch to use the automation option. The automation notification channels are as follows

• Email: This option sends an Email to the end-user whose actions triggered the violation.

• Teams: This option sends a message in MS Teams to the end-user whose actions triggered the violation

End-User Remediation

End-user remediation (also known as Human Firewall) allows you to configure remediation measures that end users can take, when a violation is detected on their Gmail Emails. You must turn on the toggle switch to use this option. End-users receive the remediation actions in an Email as an action item. The available actions in that Email depend upon the actions that you select in this section. The various available remediation actions for end-users are as follows.

• Delete File: The action permanently deletes the file from OneDrive. You can use this action here only if it is not enabled in #automated-actions.

• Move to Recycle Bin: This action deletes the file from OneDrive. Users can recover the file from OneDrive's recycle bin. You can use this action here only if it is not enabled in #automated-actions.

• Restrict to Owner: This action suspends the current file permissions and restricts the access of the file only to its owner. You can use this action here only if it is not enabled in #automated-actions.

• Report as False Positive with Business Justification: This action allows end users to report false positive alerts and provide a business justification as to why the alert is considered to be false positive.

• Report as False Positive: This action allows end users to report false positive alerts.

When end-users report alerts as false positive, you can choose the resolution method to be either Automatic or manual.

If end-users do not take any remediation action, you can set the frequency at which they must receive the notifications to take action.