SaaS Security
Policies to Detect Threats
Table of Contents
Expand All
|
Collapse All
SaaS Security Docs
-
-
- Begin Scanning an Amazon S3 App
- Begin Scanning a Bitbucket App
- Begin Scanning a Box App
- Begin Scanning ChatGPT Enterprise App
- Begin Scanning a Cisco Webex Teams App
- Begin Scanning a Confluence App
- Begin Scanning a Confluence Data Center App
- Begin Scanning a Dropbox App
- Begin Scanning a GitHub App
- Begin Scanning a Gmail App
- Begin Scanning a Google Cloud Storage App
- Begin Scanning a Google Drive App
- Begin Scanning a Jira App
- Begin Scanning a Jira Data Center App
- Begin Scanning a Microsoft Azure Storage App
- Begin Scanning a Microsoft Exchange App
- Begin Scanning a Microsoft Teams App
- Begin Scanning Office 365 Apps
- Begin Scanning a Salesforce App
- Begin Scanning a ServiceNow App
- Begin Scanning a ShareFile App
- Begin Scanning a Slack Enterprise App
- Begin Scanning a Slack for Pro and Business App
- Begin Scanning a Workday App
- Begin Scanning a Zendesk App
- Begin Scanning a Zoom App
- Perform Actions on Sanctioned Apps
- API Throttling
- Configure Classification Labels
- Microsoft Labeling for Office 365
- Google Drive Labeling
- Configure Phishing Analysis
- Configure WildFire Analysis
- Fine-Tune Policy
-
- What is an Incident?
- Filter Incidents
- Configure Slack Notification Alerts on Data Security
- Security Controls Incident Details
- Track Down Threats with WildFire Report
- Customize the Incident Categories
- Close Incidents
- Download Assets for Incidents
- View Asset Snippets for Incidents
- Modify Incident Status
- Email Asset Owners
- Generate Reports on Data Security
- Integrate CIE with Data Security
- Search in Data Security
-
-
- View Usage Data for Unsanctioned SaaS Apps
- SaaS Visibility Application Attributes
- How SaaS Security Inline Determines an App's Risk Score
- Identify Risky Unsanctioned SaaS Apps and Users
- Generate the SaaS Security Report
- Filter Unsanctioned SaaS Apps
-
- SaaS Policy Rule Recommendations
- App-ID Cloud Engine
- Guidelines for SaaS Policy Rule Recommendations
- Apply Predefined SaaS Policy Rule Recommendations
- Create SaaS Policy Rule Recommendations
- Enable SaaS Policy Rule Recommendations
- Monitor SaaS Policy Rule Recommendations
- Delete SaaS Policy Rule Recommendations
- Modify Active SaaS Policy Rule Recommendations
- Manage Enforcement of Rule Recommendations on Strata Cloud Manager
- Manage Enforcement of Rule Recommendations on Panorama
- Tag Discovered SaaS Apps
- Apply Tag Recommendations to Sanctioned Apps
- Change Risk Score for Discovered SaaS Apps
- Troubleshoot Issues on SaaS Security Inline
-
-
- Onboarding Overview for Supported SaaS Apps
- Onboard an Aha.io App to SSPM
- Onboard an Alteryx Designer Cloud App to SSPM
- Onboard an Aptible App to SSPM
- Onboard an ArcGIS App to SSPM
- Onboard an Articulate Global App to SSPM
- Onboard an Atlassian App to SSPM
- Onboard a BambooHR App to SSPM
- Onboard a Basecamp App to SSPM
- Onboard a Bitbucket App to SSPM
- Onboard a Bito AI App to SSPM
- Onboard a BlueJeans App to SSPM
- Onboard a Box App to SSPM
- Onboard a Bright Security App to SSPM
- Onboard a Celonis App to SSPM
- Onboard a Cisco Meraki App to SSPM
- Onboard a Claude App to SSPM
- Onboard a ClickUp App to SSPM
- Onboard a Codeium App to SSPM
- Onboard a Cody App to SSPM
- Onboard a Confluence App to SSPM
- Onboard a Contentful App to SSPM
- Onboard a Convo App to SSPM
- Onboard a Couchbase App to SSPM
- Onboard a Coveo App to SSPM
- Onboard a Crowdin Enterprise App to SSPM
- Onboard a Customer.io App to SSPM
- Onboard a Databricks App to SSPM
- Onboard a Datadog App to SSPM
- Onboard a DocHub App to SSPM
- Onboard a DocuSign App to SSPM
- Onboard a Dropbox Business App to SSPM
- Onboard an Envoy App to SSPM
- Onboard an Expiration Reminder App to SSPM
- Onboard a Gainsight PX App to SSPM
- Onboard a GitHub Enterprise App to SSPM
- Onboard a GitLab App to SSPM
- Onboard a Google Analytics App to SSPM
- Onboard a Google Workspace App to SSPM
- Onboard a GoTo Meeting App to SSPM
- Onboard a Grammarly App to SSPM
- Onboard a Harness App to SSPM
- Onboard a Hellonext App to SSPM
- Onboard a Hugging Face App to SSPM
- Onboard an IDrive App to SSPM
- Onboard an Intercom App to SSPM
- Onboard a Jira App to SSPM
- Onboard a Kanbanize App to SSPM
- Onboard a Kanban Tool App to SSPM
- Onboard a Krisp App to SSPM
- Onboard a Kustomer App to SSPM
- Onboard a Lokalise App to SSPM
- Onboard a Microsoft 365 Copilot App to SSPM
- Onboard a Microsoft Azure AD App to SSPM
- Onboard a Microsoft Exchange App to SSPM
- Onboard a Microsoft OneDrive App to SSPM
- Onboard a Microsoft Outlook App to SSPM
- Onboard a Microsoft Power BI App to SSPM
- Onboard a Microsoft SharePoint App to SSPM
- Onboard a Microsoft Teams App to SSPM
- Onboard a Miro App to SSPM
- Onboard a monday.com App to SSPM
- Onboard a MongoDB Atlas App to SSPM
- Onboard a MuleSoft App to SSPM
- Onboard a Mural App to SSPM
- Onboard a Notta App to SSPM
- Onboard an Office 365 App to SSPM
- Onboard Office 365 Productivity Apps to SSPM
- Onboard an Okta App to SSPM
- Onboard an OpenAI App to SSPM
- Onboard a PagerDuty App to SSPM
- Onboard a Perplexity App to SSPM
- Onboard a Qodo App to SSPM
- Onboard a RingCentral App to SSPM
- Onboard a Salesforce App to SSPM
- Onboard an SAP Ariba App to SSPM
- Onboard a ServiceNow App to SSPM
- Onboard a Slack Enterprise App to SSPM
- Onboard a Snowflake App to SSPM
- Onboard a SparkPost App to SSPM
- Onboard a Tableau Cloud App to SSPM
- Onboard a Tabnine App to SSPM
- Onboard a Webex App to SSPM
- Onboard a Weights & Biases App to SSPM
- Onboard a Workday App to SSPM
- Onboard a Wrike App to SSPM
- Onboard a YouTrack App to SSPM
- Onboard a Zendesk App to SSPM
- Onboard a Zoom App to SSPM
- Onboarding an App Using Azure AD Credentials
- Onboarding an App Using Okta Credentials
- Register an Azure AD Client Application
- View the Health Status of Application Scans
- Delete SaaS Apps Managed by SSPM
-
-
-
- New Features Introduced in December 2024
- New Features Introduced in November 2024
- New Features Introduced in October 2024
- New Features Introduced in August 2024
- New Features Introduced in July 2024
- New Features Introduced in June 2024
- New Features Introduced in May 2024
- New Features Introduced in April 2024
- New Features Introduced in March 2024
- New Features Introduced in January 2024
-
- New Features Introduced in November 2023
- New Features Introduced in October 2023
- New Features Introduced in September 2023
- New Features Introduced in August 2023
- New Features Introduced in July 2023
- New Features Introduced in June 2023
- New Features Introduced in May 2023
- New Features Introduced in April 2023
- New Features Introduced in March 2023
- New Features Introduced in January 2023
-
- New Features Introduced in December 2021
- New Features Introduced in October 2021
- New Features Introduced in September 2021
- New Features Introduced in August 2021
- New Features Introduced in July 2021
- New Features Introduced in June 2021
- New Features Introduced in May 2021
- New Features Introduced in March 2021
- New Features Introduced in January 2021
Policies to Detect Threats
Learn about the policy rules in Behavior Threats for identifying potential
threats.
Where Can I Use This? | What Do I Need? |
---|---|
|
Or any of the following licenses that include the Data Security license:
|
Policies instruct Behavior Threats to detect suspicious user activities, which might
represent a threat to your organization. Each policy identifies a specific type of user
behavior that might represent a threat, such as a user accessing SaaS apps from an
unusual location or performing bulk download operations. When you enable a policy,
Behavior Threats detects the suspicious activity and creates a threat incident for that
user.
Behavior Threats provides the following types of policies:
- Dynamic Policies—Policy rules use historical data and machine learning to identify suspicious user activity. For these policy rules, Behavior Threats examines historical user data to determine a baseline for each user in your organization. This baseline is derived from the user’s past actions and also from the actions of other users in your organization. From this baseline, Behavior Threats identifies the most anomalous user actions as threat incidents.
- Static Policies—Policy rules use preconfigured thresholds that Behavior Threats uses to detect suspicious user activity. Behavior Threats does not create a baseline of user activities or use machine learning to detect threat incidents for these policy rules. Instead, Behavior Threats records a threat incident if user actions reach the preconfigured threshold for the policy.
By default, all Behavior Threats policy rules are enabled. However, you can disable a policy if you don’t want Behavior Threats to display incidents for
that policy.
Dynamic Policies to Detect Threats
Learn about the dynamic policies in Behavior Threats for identifying potential
threats.
Dynamic policies instruct Behavior Threats to detect anomalies in specific types of user
activities by using historical data and machine learning. Behavior Threats separates
these policies into the following behavioral situations:
- Spike in Activity: Compared to historical data, a marked increase in a particular activity within a single hour.
- Bulk Activity: Compared to historical data, a marked increase in a particular activity over a span of hours.
- Time-Based Activity: Compared to historical data, an activity performed by a user at an unusual time.
- Location-Based Activity: Compared to historical data, an activity performed by a user from an unusual location.
- Sensitive Data-Transfer Activity: Compared to historical data, unusual user access to files containing Enterprise Data Loss Prevention (E-DLP) data patterns.
The historical data that Behavior Threats uses to detect anomalous user behavior is at
most 90 days.
Policy Name | Description |
---|---|
Detect spike in Application Usage
|
Instructs Behavior Threats to display spikes in usage for an
individual app within a single hour.
For this policy, Behavior Threats logs incidents based on the
number of distinct actions that a particular user performs in a
particular app. Behavior Threats identifies usage spikes based
on how the user typically interacts with the app.
Behavior Threats logs a spike in app usage only if the spike is
very unlikely compared to app usage across your
organization.
|
Detect spike in Data Downloads or Uploads
|
Instructs Behavior Threats to show when a user uploads or
downloads a large number of distinct files or folders within a
single hour.
For this policy, Behavior Threats logs incidents based on the
amount of data that the user downloaded or uploaded compared to
how much data the user typically downloads or uploads.
Behavior Threats logs a spike in upload or download activity only
if the spike is very unlikely compared to other download and
upload actions across your organization.
|
Detect spike in Share, Delete, and Edit actions
|
Instructs Behavior Threats to show spikes in Share, Delete, or
Edit actions across all SaaS apps by a single user within a
single hour.
For this policy, Behavior Threats logs incidents based on the
number of files a user shared, deleted, or edited compared to
the number of files the user typically shares, deletes, or
edits.
Behavior Threats logs a spike in Share, Delete, or Edit actions
only if it's very unlikely compared to actions taken by other
users across your organization.
|
Detect spike in User Activity
|
Instructs Behavior Threats to show when a user performs excessive
interactions with SaaS apps within a single hour.
For this policy, Behavior Threats logs incidents based on the
number of user interactions with SaaS apps compared to the
user's typical number of interactions.
Behavior Threats logs a spike in user activity only if it's very
unlikely compared to user activity across your organization.
|
Policy Name | Description |
---|---|
Detect bulk Data Downloads or Uploads
|
Instructs Behavior Threats to show when a user uploads or
downloads a large number of files or folders within a span of
hours.
For this policy, Behavior Threats logs incidents based on the
amount of data that the user downloaded or uploaded compared to
how much data the user typically downloads or uploads during the
same number of hours.
Behavior Threats logs a bulk download or upload incident only if
it's very unlikely compared to user download or upload activity
across your organization.
|
Detect bulk User Activity
|
Instructs Behavior Threats to show when a user performs excessive
interactions with a SaaS app within a span of hours.
For this policy, Behavior Threats logs incidents based on the
number of user interactions with SaaS apps compared to the
user's typical number of interactions within the same number of
hours.
Behavior Threats logs a bulk user activity incident only if it's
very unlikely compared to user activity across your
organization.
Behavior Threats logs a bulk user activity incident only if it's
very unlikely compared to user activity across your
organization.
|
Policy Name | Description |
---|---|
Detect Abnormal User Activity Hours |
Instructs Behavior Threats to show if users are active outside of
the hours that they normally access the system
For this policy, Behavior Threats logs incidents by comparing the
time a user is active with their typical hours of activity.
Behavior Threats logs an incident only if it estimates the
probability of the user being active at a particular time is
very low.
|
Policy Name | Description |
---|---|
Detect Abnormal Location Access |
Instructs Behavior Threats to show if users access SaaS apps from
an unusual location.
For this policy, Behavior Threats logs incidents by comparing the
location from which a user accesses a SaaS app to typical access
locations for the user and their peers.
Behavior Threats logs an incident only if the probability of the
user accessing an app from the location is very low.
|
Policy Name | Description |
---|---|
Detect Unusual Access to Sensitive Data |
Instructs Behavior Threats to show unusual user access to files
containing Enterprise DLP data patterns. Behavior Threats
logs the following unusual behavior:
For this policy, Behavior Threats logs incidents by comparing the
number of files containing Enterprise DLP data patterns and
the data patterns to the user's past behavior.
Behavior Threats logs an incident only if it estimates the
probability of the sensitive-data access is very low.
|
Static Policies to Detect Threats
Learn about the static policies in Behavior Threats for identifying potential
threats.
We initially introduced the static policies as predefined user
activity policies in the Data Security product. These original versions are no longer
available for newly provisioned tenants and will soon be deprecated for all tenants. If
you're currently using the legacy predefined policies, we recommend that you transition
to the new policies. By transitioning to the new policies, you ensure continued
functionality and access to the latest features.
Policy Name | Description |
---|---|
Inactive Account Access |
Instructs Behavior Threats to show when a user accesses an app by
using an inactive account. This policy considers an account inactive
if the account wasn’t accessed in over 30 days. Inactive account
access might indicate that the user’s account was breached.
|
Impossible Traveler |
Instructs Behavior Threats to show when a user accesses an app from
different locations within a time frame that couldn’t accommodate
travel between the locations. This policy determines the locations
by IP addresses. This impossible travel might indicate that the
user’s account is compromised.
|
Login Failures |
Instructs Behavior Threats to show when a user has multiple failed
login attempts to an app. Multiple login failures might indicate an
attempt to breach the user account.
For this policy, Behavior Threats logs incidents if there are more
than 5 consecutive failed login attempts within 30 minutes.
|
Malware Detection |
Instructs Behavior Threats to show when a user interacts with a file
that contains malware. This activity might identify a malicious user
and is a threat to your organization.
|
Risky IPs | Instructs Behavior Threats to show when a user accesses an app from a suspicious IP address. Suspicious IP addresses include malicious IP addresses identified by Unit 42, the Palo Alto Networks threat intelligence team. Suspicious IP addresses also include IP addresses of known Tor exit nodes and IP addresses belonging to Bulletproof Hosting Providers (BHPs). Access from a risky IP address likely indicates that the user’s account was breached. |
Unsafe Location | Instructs Behavior Threats to show when a user accesses an app from a country that the United States Department of the Treasury considers unsafe. These countries are considered unsafe because they are known origins of cyberattacks. User access from an unsafe location likely indicates that the user’s account was breached. |
Unsafe VPN | Instructs Behavior Threats to show when a user accesses an app from an unauthorized or unsanctioned VPN. These unsafe VPNs include personal VPNs and known consumer VPNs. The use of an unsafe VPN might indicate that the user is hiding their IP address to avoid auditing and tracking. The use of an unsafe VPN might also indicate that a malicious actor is attempting to decrypt traffic to steal user credentials. |