SaaS Security Administrator's Guide
    : Begin Scanning a Box App
    Focus
    Download PDF
    Focus
    1. Home
    2. SaaS Security
    3. SaaS Security Administrator's Guide
    4. Data Security
    5. Secure Sanctioned SaaS Apps on Data Security
    6. Add Cloud Apps to Data Security
    7. Begin Scanning a Box App
    Download PDF

    SaaS Security Administrator's Guide

    Begin Scanning a Box App

    Table of Contents

    Begin Scanning a Box App

    Use these steps to connect the Box application to Data Security to begin scanning assets for policy violations.
    This feature is available for Business, Business Plus, and Enterprise versions only. Personal accounts are not supported.
    To connect Box to Data Security and begin scanning files and folders, you need to:
    • Ensure that you have a Box account with has sufficient privileges.
    • Grant Data Security access to Box.
    • Add the Box app to Data Security, providing Data Security information about your Box.
    Support for automated remediation capabilities varies by SaaS application.

    Prepare To Add Box App

    Before you add the Box app, perform the prerequisites steps to make use of all the capabilities that the app supports which help in an efficient onboarding experience.
    1. (Recommended) Add your Box app domain as an internal domain.
    2. (Optional) Enable group-based Enable Group-based Selective Scanning.
      If you plan to use selective scanning using Azure Active Directory. You must retrieve your Azure AD group information before adding your Box application so Data Security can discover and scan assets belonging to the user groups you want to monitor.
    3. Next step: Proceed to Add Box App.

    Add Box App

    In order for Data Security to scan assets, you must consent to specific permissions during adding the Box app. Without the requested permissions, Data Security can't authenticate with Box and can't scan assets, even after you successfully install the Box app.
    1. Ensure that the Box account you plan to use with Data Security has sufficient privileges.
      Enabling the Edit settings for your company option suppresses email notifications. If you don't enable this setting, every collaborator on an asset receives an email notification each time Data Security accesses an asset. When you suppress an email notification, actions will still appear in the user’s update feeds and in the audit logs.
      To connect Data Security, log in to a Box account with administrator privileges. Make sure the following settings are enabled:
      1. From within the Box app, select Admin ConsoleUsers and Groups and select the administrator account you want to use.
      2. Allow this user to see all managed users.
    2. To add the Box application to Data Security, go to Data SecurityApplicationsAdd ApplicationBox.
      1. Click Connect to Box Account.
      2. Enter the email address and password for the administrator account you want Data Security to use when connecting to Box and then click Authorize.
        Data Security validates the administrator account and if the account has the right authentication permissions to access all the Box assets. If the account does not have adequate permissions, an onscreen status displays an error alerting you to fix the issue.
      3. After authentication succeeds, select Grant access to Box.
        After authentication, Data Security adds the new Box app to the Cloud Apps list as Box n, where n is the number of Box app instances that you connected to Data Security. For example, if you added one Box app, the name displays as Box 1. You’ll specify a descriptive name soon.
    3. Next step: Proceed to Customize Box App.

    Troubleshooting Onboarding for Box App

    To ensure that your app has onboarded correctly without any issues in authentication or permissions, Data Security performs validation checks between the onboarding and scanning process. You can start scanning only after a successful validation. For Box, the following validation happens:
    • App Authentication
    After the validation is successful, Data Security displays the sample user activities and data assets:
    If the App Authentication check fails, try the following:
    1. Ensure you have administrator permissions.
    2. Go to your Box app directory (https://<custom domain>.app.box.com/app-center?myApps=true) and check if your Palo Alto Networks application is listed in the list of installed apps. Following are the app names for specific regions:
      • India region: Palo Alto Networks NG-CASB - India
      • Australia region: Palo Alto Networks NG-CASB - AUS
      • Japan region: Palo Alto Networks NG-CASB - JP
      • UK region: Palo Alto Networks NG-CASB - UK
      • EU region: Aperture EU by Palo Alto Networks
      • APAC region: Aperture APAC by Palo Alto Networks
      • US region: Aperture by Palo Alto Networks
    Handling Errors
    To understand your error messages and ways to resolve them, see:
    If the issue persists, contact SaaS Security Technical Support.

    Customize Box App

    After you add the Box app, customize the app to make use of capabilities that are unique to this app.
    1. (Optional) Specify an Alternative account for quarantined files.
      You can specify a different Box account (in email address format) for the quarantine administrator for precise assignment of incident management responsibilities. If you choose not to specify an alternative account, Data Security uses the onboarding account to quarantine files in the Admin Quarantine folder. The Box account for the quarantine administrator does not need to have admin privileges. After you define this quarantine administrator, you can't modify the setting without deleting the Box app and repeating the onboarding process; therefore, use a service account that persists as administrators join and leave your organization.
    2. Click Done to save your changes.
    3. Next step: Proceed to Selective Scanning on Box App.

    Selective Scanning on Box App

    Perform selective scanning on your Box app.
    1. (Optional) Enable group-based selective scanning.
      If you have not already done so, instruct Data Security to retrieve your Azure AD group information, then return to this step to choose the user groups.
      You cannot change the status of selective scanning for your Box app which has already started scanning.
    2. You can choose to either Scan or Exclude From Scan your user groups.
    3. Choose your groups from the Available Groups list and move them to the Selected Groups list.
    4. Click Save.
      You can perform each of the above 4 steps any number of times and make any changes as long as you have not started scanning your Box app. However, if you have started scanning, all operations related to selective scanning are disabled.
    5. Next step: Proceed to Start Scanning and Monitor Results.

    Start Scanning and Monitor Results

    When you add a new cloud app, then enable scanning, Data Security automatically scans the cloud app against the default data patterns and displays the match occurrences. You can take action now to improve your scan results and identify risks.
    1. To Start scanning the new Box app for risks, go to Data SecurityApplicationsBoxEnable Scanning.
    2. Monitor the scan results.
      During the discovery phase, as Data Security scans files and matches them against enabled policy rules, verify that your default policy rules are effective. If the results don’t capture all the risks or you see false positives, proceed to the next step to improve your results.
    3. (Optional) Modify match criteria for existing policy rules.
    4. (Optional) Add new policy rules.
      Consider the business use of your cloud app, then identify risks unique to your enterprise. As necessary, add new:
    5. (Optional) Configure or edit a data pattern.
      You can Configure Data Patterns to identify specific strings of text, characters, words, or patterns to make it possible to find all instances of text that match a data pattern you specify.

    © 2024 Palo Alto Networks, Inc. All rights reserved.