Rule Count Mismatch: Policy vs Findings

When reviewing findings in your SaaS security platform, you may notice a difference between the total number of rules added to a policy and the number of rules that appear as evaluated on the Findings page.

As shown in the video above, 12 rules are added to the policy, but only 8 are evaluated in the Findings. The remaining 4 rules are not evaluated and can occur due to the following reasons:

Absence of Resources

1. Insufficient permissions – Insufficient permissions granted during the onboarding of the SaaS application can hinder the system’s ability to access necessary resources.

2. Unsupported resource types – The specific type of resource doesn’t exist or isn’t available in the connected SaaS application. For example, ManagedDevice and DeviceConfigurationPolicy Intune resources cannot be fetched if Intune SKU is not enabled for your instance.

3. Consequently, rules that depend on these unavailable resources will not generate findings.

4. Verification Steps:

   • Identify the unevaluated rule.

   • Determine the resource type associated with the rule.  For example, in microsoft365 remotedomain should-have autoforwardenabled = false query, remotedomain is the resource type.

   • Navigate to the Inventory menu and filter by the Resource Type.

   • If the resource type is not visible, this may indicate a permission issue or absence of a resource.

5. Troubleshooting Steps:

   • Verify the permissions granted during the onboarding process. See Onboard SaaS Apps for the supported apps and the permissions required.

   • Confirm the existence of the resource within the SaaS app.

Where Clause Limitation

1. Rules incorporating a where clause will only produce findings if a minimum of one matching resource is found in the inventory.

2. During rule evaluation, if the where clause finds no match, no findings are generated.

3. Troubleshooting Steps:

   • Identify the unevaluated rule.

   • Click on the rule in the policy.

   • Select Search in Inventory option. You will be navigated to the Inventory menu > Resources tab.

   • If no results show up, it indicates no resources match the condition.

References

• Onboard SaaS Apps in SSPM