To create inline policies that are meant to block risky activities in Low or poor CCL apps, follow the steps as shown below:
- Navigate to Policies > Real time Protection > New Policy > Cloud App access.
- Under ‘Destination’ section, select the ‘Category’ option. Add the list of categories that should be checked for risky activities in low or poor CCL apps.
- Under ‘Add Criteria and Constraints’, select the option ‘CCL’ and select the options ‘Low’ and ‘Poor’.
- Under ‘Profile & Action’, select action = block.
The policy results can be seen in Skope IT > Alerts by selecting filters ‘Action eq block’ and ‘Alert_type eq Policy’ and CCL eq ‘Low’ or CCL eq ‘Poor’.
To learn more: Real-time Protection Policies