Classic API Data Protection Feature Matrix per Cloud App

Classic API Data Protection Feature Matrix per Cloud App

To view the policy actions for Next Generation API Data Protection cloud apps, see Next Generation API Data Protection Feature Matrix per Cloud App.

You can set up various actions to perform once a policy is triggered. Netskope supports the following actions to mitigate risk exposure:

  • Policy Alerts: Generates alerts on the Skope IT > Alerts page when a policy matches.

  • UEBA alerts: Generates User Entity Behavior Analytics (UEBA) alerts on the Skope IT > Alerts page. To learn more on UEBA: Behavior Analytics.

  • Audit: The audit action generates audit logs/events such as any change made in the SaaS app (upload, download, delete, and more) that Netskope retrieves using API calls. You can view the audit logs/events on the Skope IT > EVENTS > Application Events page of the Netskope UI.

  • DLP: The DLP profiles that enforce compliance and protect sensitive data consist of DLP rules that specify data identifiers. These data identifiers find content that should not be present in cloud app transactions or public cloud storage.

  • Threat Protection: Scans files stored in your cloud storage applications for malware.

  • Retroactive Scan: A retroactive policy scans all the files and folders for the app instance right from the inception of the SaaS app.

    Netskope supports one active retroactive scan per application instance. If you intend to scan the same content against multiple policies, you can do so by combining these policies together under a single retroactive scan.
  • Email Notification: API Data Protection supports email notification in policy wizard. With this feature, you can define an email notification for events in the policy wizard. These notifications, triggered by events like policy violations or alerts, provide administrators and designated user groups with timely information about important activities.

  • Block Access: Netskope blocks channel messages, direct messages, and attachments that violate a DLP policy. When a message is sent and received as a direct message or in a channel, and if the message is DLP sensitive, the policy applies the block access action. The policy blocks the message for the sender as well as the recipient(s). On the MS Teams chat app, the sender and recipient(s) receive this block message – This message was blocked. What can I do? The sender can click the What can I do? link to report the issue to the administrator. Though the policy blocks the message for the sender and recipient(s), the sender can still view and edit the message. Once edited, the message becomes unblocked if it does not violate the DLP policy. However if the edited message is DLP sensitive, the policy applies the block access action again. The Netskope tenant administrator can see the message details that has been blocked under Incidents > DLP, but cannot download the message content.

    • This action can be applied for DLP policies only.
    • This action applies to Microsoft Office 365 Teams only.
  • Delete: Deletes a file from the cloud app when a policy matches.

    This action is available only if you select a DLP profile from the API Data Protection policy workflow.
  • Encrypt: Allows you to encrypt a file if it matches policy criteria. Encryption must be enabled in your tenant instance to use this feature. Contact support () if you do not see this as an action in the policies.

Cloud AppPolicy AlertsUEBA AlertsAuditDLPThreat ProtectionRetroactive ScanEmail NotificationBlock Access*DeleteEncrypt$

Amazon S3

Yes

No

Yes

Yes

Yes

Yes

Yes

No

No

No

Box

Yes

Yes

Yes

Yes

Yes

Yes

Yes

No

Yes

Yes

Cisco Webex Teams

Yes

Yes

No

Yes

Yes

No

Yes

No

Yes

No

Dropbox

Yes

Yes

Yes

Yes

Yes

Yes

Yes

No

Yes

Yes

Egnyte

Yes

Yes

Yes

Yes

Yes

Yes

Yes

No

No

Yes

GitHub

Yes

No

Yes

No

No

No

Yes

No

No

No

Gmail

Yes#

Yes

No

Yes%

No

No

Yes

No

No

No

Google Cloud Storage

Yes

Yes

No

Yes

Yes

Yes

Yes

No

No

No

Google Drive^

Yes

Yes

Yes

Yes

Yes

Yes

Yes

No

Yes

Yes

Microsoft Azure Blob Storage

Yes

No

No

Yes

Yes

Yes

Yes

No

No

No

Microsoft OneDrive

Yes

Yes

Yes

Yes

Yes

Yes

Yes

No

Yes

Yes

Microsoft Outlook

Yes#

No

Yes

Yes%

No

No

Yes

No

No

No

Microsoft SharePoint

Yes

Yes

Yes

Yes

Yes

Yes

Yes

No

No

Yes

Microsoft Teams

Yes

Yes

Yes

Yes**

Yes

No

Yes

Yes

No

No

Salesforce structured data (Chatter messages and posts)

Yes

Yes

Yes

Yes

Yes

Yes

Yes

No

No

No

Salesforce unstructured data (files)

Yes

Yes

Yes

Yes

Yes

Yes

Yes

No

No

No

ServiceNow

Yes

Yes

No

Yes

Yes$$

Yes

Yes

No

No

No

Slack Enterprise

Yes

Yes

Yes

Yes

Yes##

No

Yes

No

Yes%%

No

Slack Team

Yes

Yes

No

Yes

No

No

Yes

No

No

No

Workplace by Facebook

Yes

Yes

Yes

Yes

No

No

Yes

No

Yes^^

No

*This action applies to Microsoft Office 365 Teams only.

$If you use the encrypt policy action, ensure that you have a Netskope real-time deployment i.e., a reverse or forward proxy. The Netskope real-time deployment is required to decrypt the file. For more information, see File Encryption in API Data Protection FAQ.

#Netskope does not scan emails in deleted/trash folder. Netskope will continue to scan emails in sent folder.

%Netskope does not scan emails in deleted/trash folder. Netskope will continue to scan emails in sent folder. Regular file attachments get scanned for DLP. If you attach a file using Google Drive, note the following behavior:

  • Insert file as a link – DLP policy hit on the body and subject of the sent email.

  • Insert file as an attachment – DLP policy hit on the body and subject of the sent email.

^Netskope does not get any notification when an internal user edits a file owned by an external user. In a nutshell, externally owned files are not audited by Google. This is a known limitation in Google Drive.

**Microsoft does not provide any webhook notification for files uploaded through the files and wiki tab of Microsoft Teams. Due to this limitation, Netskope does not support DLP scanning for such file uploads. However, Netskope detects files sent as an attachment from a channel’s chat window. For full DLP coverage, you should set up respective API Data Protection instances for Microsoft Office 365 OneDrive and SharePoint.

$$Threat protection for ServiceNow applies to files and attachments only.

##Threat protection for Slack Enterprise applies to files only. Chat messages are snippets are not supported.

%%When an external user upload a file on a Slack Connect channel, Netskope cannot perform delete (write) action on the file. This is because the file belongs to another organization.

Once Netskope performs a delete action on a file, the Netskope tenant administrator may still have access to the deleted file from the Incidents > DLP page. This can happen if the Slack enterprise account has a retention policy to preserve the file. Though Netskope deletes the file from the Slack channel, the file may still be available to downloaded from the Netskope tenant. Check your data retention policy with Slack support.

^^The delete action for Workplace by Facebook applies to group posts and comments. This action does not apply to chat messages.

  • Change owner: This action changes the owner of the file to the administrator. Designates the administrative owner of files and folders for which the policy is applied.

  • Restrict Access: Depending on the app, there are different options available to restrict a publicly or externally shared file. Here are the restriction options for each supported cloud app:

Cloud AppChange OwnerRestrict Access to OwnerRestrict Access to Internal CollaboratorsRestrict Access to Specific DomainRestrict Access - Remove Organization Wide LinkRestrict Access - Blocklist External DomainsRestrict Access - Remove Individual UserRestrict Access - Remove Public Links

Amazon S3

No

No

No

No

No

No

No

No

Box

No

Yes

Yes

Yes

No

Yes

No

Yes

Cisco Webex Teams

No

No

No

No

No

No

No

No

Dropbox

No

Yes

Yes

Yes

No

Yes

No

Yes

Egnyte

Yes

Yes

Yes

Yes

No

Yes

No

Yes

GitHub

No

No

No

No

No

No

No

No

Gmail

No

No

No

No

No

No

No

No

Google Cloud Storage

No

No

No

No

No

No

No

No

Google Drive

Yes

Yes

Yes

Yes

No

Yes

No

Yes

Microsoft Azure Blob Storage

No

No

No

No

No

No

No

No

Microsoft OneDrive

No

Yes

Yes

No

Yes

No

Yes

Yes

Microsoft Outlook

No

No

No

No

No

No

No

No

Microsoft SharePoint

No

Yes

Yes

No

Yes

No

Yes

Yes

Microsoft Teams

No

No

No

No

No

No

No

No

Salesforce structured data (Chatter messages and posts)

No

No

No

No

No

No

No

No

Salesforce unstructured data (files)

No

No

No

No

No

No

No

No

ServiceNow

No

No

No

No

No

No

No

No

Slack Enterprise

No

No

No

No

No

No

No

No

Slack Team

No

No

No

No

No

No

No

No

Workplace by Facebook

No

No

No

No

No

No

No

No

  • Quarantine: Allows you to quarantine a file if a user uploads a document that has a DLP violation. This moves the file to a quarantine folder for you to review and take appropriate action (allow the file to be uploaded or block the file from being uploaded).

    This action is available only if you select a DLP profile from the API Data Protection policy workflow.
  • Legal Hold: Preserves all forms of relevant information when litigation is reasonably anticipated. You can choose to have a copy of the file saved for legal purpose if it matches policy criteria.

  • Forensic: Allows you to apply a forensic profile that flags policy violations and then stores the file in a forensic folder.

  • Azure Rights Management: Azure Rights Management Services (RMS) is cloud-based service which uses encryption, identity, and authorization policies to secure Microsoft files like Word, Excel, PowerPoint, and more. The RMS action applies an RMS template to a Microsoft Office file uploaded in OneDrive for Business only.

  • Vera: Netskope integrates with Information Rights Management (IRM) systems such as Vera to protect your sensitive information from being shared with unauthorized users through cloud applications.

  • Microsoft Information Protection (MIP): Netskope integrates with Information Rights Management (IRM) systems such as MIP to protect your sensitive information from being shared with unauthorized users through cloud applications.

  • Expire Externally Shared Links: Sets an expiration in days for files with publicly shared links.

Cloud AppRestrict Collaborators to View-only PermissionRestrict Access - Allowlist External DomainsRestrict Collaborators - Disable Print and DownloadQuarantine*Legal HoldForensicRMSVeraMIPExpire Externally Shared Links#

Amazon S3

No

No

No

No

No

Yes

No

No

No

No

Box

Yes~

Yes

Yes&

Yes

Yes

Yes

No

Yes

Yes

Yes^

Cisco Webex Teams

No

No

No

No

No

No

No

No

No

No

Dropbox

No

Yes

No

Yes

No

No

No

Yes

No

No

Egnyte

No

Yes

No

No

No

Yes

No

Yes%

No

No

GitHub

No

No

No

No

No

No

No

No

No

No

Gmail

No

No

No

No

No

No

No

No

No

No

Google Cloud Storage

No

No

No

No

No

Yes

No

No

No

No

Google Drive

Yes

Yes

Yes

Yes

Yes

Yes

No

Yes%

Yes

No

Microsoft Azure Blob Storage

No

No

No

No

No

Yes

No

No

No

No

Microsoft OneDrive

No

No

No

Yes

Yes

No**

Yes

Yes

Yes

No

Microsoft Outlook

No

No

No

No

No

No

No

No

No

No

Microsoft SharePoint

No

No

No

Yes

No

Yes

No

Yes

Yes

No

Microsoft Teams

No

No

No

Yes$$

No

No

No

No

No

No

Salesforce structured data (Chatter messages and posts)

No

No

No

No

Yes

No

No

No

No

No

Salesforce unstructured data (files)

No

No

No

No

Yes

No

No

No

No

No

ServiceNow

No

No

No

No

No

No

No

No

No

No

Slack Enterprise

No

No

No

Yes##

Yes

No

No

No

No

No

Slack Team

No

No

No

No

Yes~~

No

No

No

No

No

Workplace by Facebook

No

No

No

No

No

No

No

No

No

No

*This action is available only if you select a DLP profile from the API Data Protection policy workflow.

#You can configure the number of days for which you want the link to expire. This is particularly useful for externally shared files and public files.

~Box does not directly support the view only action. To support this action, the file is locked and the permissions of all the collaborators in the Box folder are set to Previewer Uploader access level so that the collaborators cannot unlock the file.

&Box does not directly support the disable download action for certain users. To support this action, the file is locked along with the disable download action enabled.

^In Box Admin Console > Enterprise Settings > Content > Sharing > Auto-Expiration > Allow item owners and editors to modify the expiration date must be enabled for Expire Externally Shared Links to work.

%Egnyte and Google Drive apps do not use Vera’s partner tags.

**Based on Microsoft’s latest Terms of Service, Netskope can no longer support OneDrive as a forensic destination from release 106.0.0. Due to this, Netskope will not support this feature in any new commercial or federal Netskope DC. Fine prints:

  • For existing customers who are using OneDrive as a forensic destination, the feature will continue to work as expected.

  • For new customers, the instance setup UI for OneDrive will no longer have the forensic checkbox. New forensic OneDrive instances cannot be enabled.

  • For existing customers who have not enabled OneDrive as a forensic destination, cannot enable it going forward.

  • Existing customers using OneDrive as a forensic destination, can disable the forensic checkbox from the UI. However, once disabled, you cannot re-enable it.

To learn more: Deprecation Notice for OneDrive as a Forensic Destination.

As an alternative, Netskope recommends to use a public cloud storage (like Azure Blob, AWS S3, or GCP Cloud Storage) as a forensic destination over a SaaS storage app. For more information, see Forensics.

$$You cannot create an exclusive quarantine profile for Microsoft Teams. If you have set up an Office 365 OneDrive or SharePoint app, you can leverage the quarantine profile of these apps.

##When an external user upload a file on a Slack Connect channel, Netskope cannot perform quarantine action on the file. This is because the file belongs to another organization.

~~Slack for Team Legal Hold action is applicable to files only.

Order of Policy Actions Within a Single App

For multiple policies with different actions, Netskope executes all the actions applicable to the notification in the following order:

  1. Threat Quarantine

  2. Threat Alert

  3. Alert/ DLP Alert

  4. Revoke

  5. Legal Hold

  6. File Classification

  7. Disable Download

  8. Restrict to View

  9. Restrict Access

  10. Expire Link

  11. Delete

  12. RMS (After this action exit policy processing)

  13. IRM

  14. Quarantine

  15. Encrypt

  16. Change Ownership

  17. Block Access

Share this Doc

Classic API Data Protection Feature Matrix per Cloud App

Or copy link

In this topic ...