About DLP

Workflow Settings

Incidents can be escalated to the manager of the user that triggered the incident. This allows the manager of the acting user to give their verdict, whether the triggering action is required for business purposes or if it violates the company policy. Based on this feedback, the analyst can decide how to proceed with the incident resolution.

The manager must click on the appropriate verdict to complete the workflow. Once a verdict is provided, the verdict cannot be modified and clicking the other verdict will have no effect.

Reminder emails will be sent to the manager 20 days after triggering the workflow.

Workflows expire after 30 days of triggering and will transition to a No Response state, at which point the analyst can re-trigger the workflow.

Prerequisites

Before configuring remediation workflows, ensure the following requirements are met:

• Custom SCIM Attributes are enabled in your organization to retrieve manager email addresses.
• The acting user is imported into the Netskope tenant and has a valid manager email configured in their SCIM profile.
• Your Real-Time Protection policy includes the Add SMTP Header action to quarantine flagged messages. To learn more: Real-Time Protection Policies.

Authorizing Microsoft Exchange Integration

For email quarantine remediation workflows in Microsoft Exchange, complete the following authorization steps:

Step 1: Grant Unified Auth in Netskope

1. From the Netskope admin console, go to Incidents > DLP.
2. On the right-hand side, click Workflow Settings.
3. In the Workflow Settings pane, select the Integrations tab.
4. Click Microsoft Exchange, sign in with your Microsoft 365 administrator account, and accept the consent prompt.
   • When consent succeeds, Microsoft adds the Netskope for SMTP Workflow enterprise application to your Microsoft Entra tenant.

Step 2: Assign the Security Administrator Role in Azure Portal

1. Sign in to the Azure portal with the same Microsoft tenant.
2. In the top search bar, enter Microsoft Entra roles and administrators and select Microsoft Entra roles and administrators under Services.
3. In the All roles page, search for and select Security Administrator.
4. Click Add assignments.
5. Search for Netskope for SMTP Workflow, select it, and click Add.

Configuring Approver Mapping

The approver mapping configuration is global for your tenant. To map the custom attribute for manager escalations and email release requests:

1. From the Netskope admin console, go to Incidents > DLP.

2. On the right-hand side, click Workflow Settings.

3. In the Workflow Settings pane, select the Approver Mapping tab.

4. Under Custom Attribute for Manager Email, click the Manager Email – Custom Attribute drop-down list.

   

5. Select the custom attribute that stores the manager email address for your users.

6. Click Save.

After configuring the workflow, refresh the page to enable the workflow options in the incident details view.

Initiating Workflows

You can initiate remediation workflows directly from the DLP incident details page:

1. From the admin console, go to Incidents > DLP.

2. Click the incident that you want to remediate.

3. Choose the appropriate remediation action:

   Escalating Incidents to Managers

   1. On the right-hand side, click Initiate Workflow > Escalate to Manager.

      

      This sends an email notification to the user’s manager asking for their verdict whether the Action is required for business or the Action violates company policy.

      

   Releasing Quarantined Emails (Microsoft Exchange)

   For Email DLP incidents where an email was quarantined in Microsoft Exchange:

   • Direct Release: Click RELEASE EMAIL in the top action bar to immediately release the quarantined email to the recipients without requesting manager approval.

   • Request Manager Approval: Click INITIATE WORKFLOW > Request Approval to Release Email. The workflow initiates immediately and sends an email notification to the sender’s manager.

     When you trigger the workflow:

     • The sender receives a notification email confirming that the approval workflow was triggered.
     • An email notification is sent to the sender’s manager with incident details, including the sender, recipients, subject, timestamp, attachment names, and the specific DLP rules and severity levels violated. The manager can click Release or Reject directly from the email notification.
     • Both the sender and the analyst receive email notifications regarding the manager’s approval or rejection verdict.

Workflow Statuses and Tooltips

The following table describes the interface states and tooltips displayed for remediation workflows:

All workflow actions, manager responses, and release operations are recorded in the incident details under Incident Workflow Details and Object History.