Google Drive Labeling
Table of Contents
Expand all | Collapse all
-
-
- Allowed List of IP Addresses
-
- Begin Scanning a Bitbucket App
- Begin Scanning a Box App
- Begin Scanning ChatGPT Enterprise App
- Begin Scanning a Cisco Webex Teams App
- Begin Scanning a Confluence App
- Begin Scanning a Confluence Data Center App
- Begin Scanning a Dropbox App
- Begin Scanning a GitHub App
- Begin Scanning a Gmail App
- Begin Scanning a Google Drive App
- Begin Scanning a Jira App
- Begin Scanning a Jira Data Center App
- Begin Scanning a Microsoft Exchange App
- Begin Scanning Office 365 Apps
- Begin Scanning a Microsoft Teams App
- Begin Scanning a Salesforce App
- Begin Scanning a ServiceNow App
- Begin Scanning a ShareFile App
- Begin Scanning a Slack Enterprise App
- Begin Scanning a Slack for Pro and Business App
- Begin Scanning a Workday App (Beta)
- Begin Scanning a Zendesk App
- Begin Scanning a Zoom App
- Reauthenticate to a Cloud App
- Verify Permissions on Cloud Apps
- Start Scanning a Cloud App
- Rescan a Managed Cloud App
- Delete Cloud Apps Managed by Data Security
- API Throttling
- Configure Classification Labels
- Microsoft Labeling for Office 365
- Google Drive Labeling
- Configure Phishing Analysis
- Configure WildFire Analysis
-
-
-
- What is an Incident?
- Assess New Incidents on Data Security
- Filter Incidents
- Configure Slack Notification Alerts on Data Security
- Security Controls Incident Details
- Track Down Threats with WildFire Report
- Customize the Incident Categories
- Close Incidents
- Download Assets for Incidents
- View Asset Snippets for Incidents
- Analyze Inherited Exposure
- Email Asset Owners
- Modify Incident Status
-
-
-
- What’s SaaS Security Inline?
- Navigate To SaaS Security Inline
- SaaS Visibility for NGFW
- SaaS Visibility and Controls for NGFW
- SaaS Visibility for Prisma Access
- SaaS Visibility and Controls for Panorama Managed Prisma Access
- SaaS Visibility and Controls for Cloud Managed Prisma Access
- Activate SaaS Security Inline for NGFW
- Activate SaaS Security Inline for VM-Series Firewalls with Software NGFW Credits
- Activate SaaS Security Inline for Prisma Access
- Connect SaaS Security Inline and Strata Logging Service
- Integrate with Azure Active Directory
-
-
- SaaS Policy Rule Recommendations
- App-ID Cloud Engine
- Guidelines for SaaS Policy Rule Recommendations
- Predefined SaaS Policy Rule Recommendations
- Apply Predefined SaaS Policy Rule Recommendations
- Create SaaS Policy Rule Recommendations
- Delete SaaS Policy Rule Recommendations
- Enable SaaS Policy Rule Recommendations
- Modify Active SaaS Policy Rule Recommendations
- Monitor SaaS Policy Rule Recommendations
-
- Enable Automatic Updates for SaaS Policy Rule Recommendations on Cloud Managed Prisma Access
- Import New SaaS Policy Rule Recommendations on Cloud Managed Prisma Access
- Update Imported SaaS Policy Rule Recommendations on Cloud Managed Prisma Access
- Remove Deleted SaaS Policy Rule Recommendations on Cloud Managed Prisma Access
- Manage Enforcement of Rule Recommendations on NGFW
- Manage Enforcement of Rule Recommendations on Panorama Managed Prisma Access
- Change Risk Score for Discovered SaaS Apps
-
-
-
-
- Onboarding Overview for Supported SaaS Apps
- Onboard an Aha.io App to SSPM
- Onboard an Alteryx Designer Cloud App to SSPM
- Onboard an Aptible App to SSPM
- Onboard an ArcGIS App to SSPM
- Onboard an Articulate Global App to SSPM
- Onboard an Atlassian App to SSPM
- Onboard a BambooHR App to SSPM
- Onboard a Basecamp App to SSPM
- Onboard a Bitbucket App to SSPM
- Onboard a BlueJeans App to SSPM
- Onboard a Box App to SSPM
- Onboard a Bright Security App to SSPM
- Onboard a Celonis App to SSPM
- Onboard a Cisco Meraki App to SSPM
- Onboard a ClickUp App to SSPM
- Onboard a Confluence App to SSPM
- Onboard a Contentful App to SSPM
- Onboard a Convo App to SSPM
- Onboard a Couchbase App to SSPM
- Onboard a Coveo App to SSPM
- Onboard a Crowdin Enterprise App to SSPM
- Onboard a Customer.io App to SSPM
- Onboard a Databricks App to SSPM
- Onboard a Datadog App to SSPM
- Onboard a DocHub App to SSPM
- Onboard a DocuSign App to SSPM
- Onboard an Envoy App to SSPM
- Onboard an Expiration Reminder App to SSPM
- Onboard a Gainsight PX App to SSPM
- Onboard a GitHub Enterprise App to SSPM
- Onboard a GitLab App to SSPM
- Onboard a Google Analytics App to SSPM
- Onboard a Google Workspace App to SSPM
- Onboard a GoTo Meeting App to SSPM
- Onboard a Grammarly App to SSPM
- Onboard a Harness App to SSPM
- Onboard a Hellonext App to SSPM
- Onboard an IDrive App to SSPM
- Onboard an Intercom App to SSPM
- Onboard a Jira App to SSPM
- Onboard a Kanbanize App to SSPM
- Onboard a Kanban Tool App to SSPM
- Onboard a Kustomer App to SSPM
- Onboard a Lokalise App to SSPM
- Onboard a Microsoft Azure AD App to SSPM
- Onboard a Microsoft Outlook App to SSPM
- Onboard a Microsoft Power BI App to SSPM
- Onboard a Miro App to SSPM
- Onboard a monday.com App to SSPM
- Onboard a MongoDB Atlas App to SSPM
- Onboard a MuleSoft App to SSPM
- Onboard a Mural App to SSPM
- Onboard an Office 365 App to SSPM
- Onboard an Okta App to SSPM
- Onboard a PagerDuty App to SSPM
- Onboard a RingCentral App to SSPM
- Onboard a Salesforce App to SSPM
- Onboard an SAP Ariba App to SSPM
- Onboard a ServiceNow App to SSPM
- Onboard a Slack Enterprise App to SSPM
- Onboard a Snowflake App to SSPM
- Onboard a SparkPost App to SSPM
- Onboard a Tableau Cloud App to SSPM
- Onboard a Webex App to SSPM
- Onboard a Workday App to SSPM
- Onboard a Wrike App to SSPM
- Onboard a YouTrack App to SSPM
- Onboard a Zendesk App to SSPM
- Onboard a Zoom App to SSPM
- Onboarding an App Using Azure AD Credentials
- Onboarding an App Using Okta Credentials
- Register an Azure AD Client Application
- View the Health Status of Application Scans
- Delete SaaS Apps Managed by SSPM
Google Drive Labeling
Learn how to configure Google Drive labels in Data Security.
Palo Alto Networks' use and transfer of information received from Google APIs to
any other app will adhere to Google API Services User Data Policy,
including the Limited Use requirements. For more information on how information
may be captured, processed, and stored by and within the service, refer to the
SaaS Security Privacy document. Data Security does not share your data with third-party tools, such as
AI applications.
Where Can I Use This? | What Do I Need? |
---|---|
| One of the following:
|
Data Security supports Google Drive Labeling for Google Drive connectors. As
an administrator, you can define rules and apply Data Security settings to
badged fields within labels on Google Drive files. This helps classify and protect
sensitive information effectively.
Configure Labeling for Google Drive
Prerequisite: Create and Publish Drive Labels
Data Security needs permissions to fetch the labels available
in the Google Drive instance and their priorities. To grant permissions, perform
the following steps.
- To configure labeling, select SaaS SecuritySettingsData Label Settings.The Google Drive instances which support data labeling are listed.If you have not fetched data labels for an existing onboarded Google Drive connector, choose your Google Drive connector instance and Authorize to fetch their labels.Ignore the following warning message and click Go to paloaltonetworks.com (unsafe).Ensure that the email address mentioned in the warning message is dl-datasecurity@paloaltonetworks.com.Select all and Continue.After authorization, labels with badged fields are fetched for the Google Drive connector immediately. Labels are refreshed every 24 hours.To fetch labels at any point in time, click Sync Data Labels Now.
Apply Labeling with Data Asset Policies
Perform the following steps to apply labeling with Data Asset Policies.- Select Data SecurityPoliciesAdd Policy.Enter Basic Information.Choose the Match Criteria (including Label) as needed.Choose the Auto Remediation action.Enable Apply Data Label under the Other Actions section.Choose the Google Drive connector instance and the required label from the drop-down list.When you configure a policy, you cannot choose to quarantine and label at the same time.
How Policy Driven Labeling Applies Labels
After data asset policies are configured to apply labels, Data Security regularly scans files (folders cannot be labeled) and attempts to apply the label. A label is only applied if both the following criterion are met:- The number of labels on the file should be less than the maximum number of manual labels permitted by Google (typically 5).
- If the file is already set to a different value from the same Badged label, then the value will be applied only if it is a higher priority label.
- Top Secret
- Confidential
- Internal
- Public
For a file with the Confidentiality label set to a value of Confidential, a policy that tries to apply Internal will notice that this is a priority downgrade, and so, will not change the value so as to keep the data secure. However, a policy that tries to apply Top Secret will be successful since the change is to a higher priority value. Additionally, a policy that tries to set a different label altogether (for example, Department) will not have any priority conflicts and so, will be applied successfully as long as the maximum labels limit has not been reached.View and Override Labels
- To view the assets labeled by their respective policies, select Data SecurityData AssetsLabeled by Policy. Use the various filters available at the top of the table to filter your results. As an example, the following screen shot shows a specific asset in a specific instance of Google Drive.To override an existing label, select the asset and override with a different label.
- If you override the labels manually for an asset, those assets will not be labeled by Data Asset Policies in the future.
- Select the Prevent Downgrade option to prevent users from downgrading the asset to a lower priority labeling.
Quotas for Labeling
LicensesRecent Files (< 24 Hours)Older Files (> 24 hours)All customers25000 labels per day5000 labels per dayImportant Things to Remember- Labels are available only for Google Drive connectors which have been onboarded.
- Manual overriding of labeling is limited to 500 per day.
- Files less than 24 hours old (file content change or label change) are prioritized and allocated to the Recent Files quota while files older than 24 hours are allocated to the Older Files quota.
- If the number of files to be labeled are more than your daily quota, those extra files are added to the backlog. However, these extra files are allocated to the Older Files category.