Add a New Scan Playbook

Playbooks define the plan and actions of scan results. To add a new Scan Playbook:

1. From the left menu, click Scans.

2. Select Scan Playbooks.

3. In the top right of the screen, click Actions.

4. Click Add Playbook.

5. In the New Playbook pop-up window, type the name and description of the playbook.

6. Click Continue to create or Cancel to discard.

7. Expand a section for how to do the following steps:

1. Decision Point: Click the Decision Point icon to open the Decision Point pop-up window.

2. Step Logic: In the Name box, type the name of the step logic. For example: MyStepLogic.

3. Logic:

a. Left criteria drop-down list: Select an option. For example: Access Data.

b. Center criteria drop-down list: Select an option. (The options available are determined by the initial criteria choice.) For example: On.

c. All Day toggle: Set toggle to On for all day. Set toggle to Off to set a specific Date/Time.

Note: The All Day toggle is only available for options that include date and time.

d. Right criteria drop-down list: Fill in as applicable. For example: 03/01/2021.

e. To add a new group containing a filter value plus one additional value, click the plus icon.

f. Select options from the left and center criteria drop-down lists as above.

g. In the right criteria box, the available options are dependent on your previous choices. For example: Click the more options menu (...).

h. In the Select Items pop-up window, do the following:

1) Type an item to search in the Search box.

2) Click the right arrow to select an item to add.

3) Click the left arrow to remove an item from the list.

4) Click OK to add the criteria or Cancel to discard.

i. In the Decision Weight section, use the numeric updown control to select a weight for the logic statement.

j. Click Save to save the logic statement or Cancel to discard.

Note: Adding multiple filter criteria can affect the scan performance.

Note: Not all repositories allow all logic scenarios to be performed so some logic statements will not function. (ie. many cloud repositories do not track Access Dates)

Select options from the Select Action drop-down lists:

1. Step Logic No: Applies the action when a data match is not found.

2. Step Logic Yes: Applies the action when a data match is found.

3. Select Action: Select one option from the drop-down list:

4. Expand a section for more information:

1. Select Classification from the Select Action drop-down list.

2. Action Options: Select one from the drop-down list:

  • Perform Action on File and Databases

  • Perform Action on Databases Only

3. Classification Type: Select one from the drop-down list:

  • New Classification: Adds a new classification to the search results.

  • Remove Classification: Removes a classification from the search results.

  • Replace Classification: Replaces a classification in the search results.

4. Select Classification: Select an option from the drop-down list. See Manage Classification to manage classifications.

5. Automate Action: Select to apply the action automatically.

1. Select User Action from the Select Action drop-down list.

2. In the Provide Instructions box, type the specific user action needed.

To assign a user or role:

1. Select Assign from the Select Action drop-down list.

2. Select User or Role: Select an option from the drop-down list.

3. Automated Action: Select to apply the action automatically.

To notify assignees of results:

1. Select Notify from the Select Action drop-down list.

2. Custom Notification Template: Select an option from the drop-down list.

3. Enter Email Address(es): Type the email address to notify. Click Enter on your keyboard to add multiple email addresses.

4. Automated Action: Select to apply the action automatically.

To use Microsoft Information Protection (MIP) labels to apply to the results:

1. Select MIP Label from the Select Action drop-down list.

2. Select Microsoft Label: Select an option from the drop-down list.

3. Label Application: Select an option from the drop-down list.

4. Automated Action: Select to apply the action automatically.

Note: This option is requires purchase of a MIP license.

1. Select an option from the Remediation section of the Select Action drop-down list:

a. Restrict Access: Restrict access to specific users.

1) Do Not Restrict Access: Select an option from the drop-down list.

2) Automated Action: Select to apply the action automatically.

b. Quarantine: Quarantine paths are managed by the administrators in the Remediation section of the Scans Settings page. Select the Automated Action to apply the action automatically.

c. Shred: Permanently deletes a file. No further action can be taken.

1) Automated Action: Select to apply the action automatically.

d. Redact: Redacts the results when the Spirion application is closed.

1) Redaction setting mare managed by the Admin in Platform Settings.

2) Automated Action: Select to apply the action automatically.

e. Execute Script: Execute a script if there are results matching this rule.

1) Select an option from the Select Script drop-down list.

2) Automated Action: Select to apply the action automatically.

f. Take No Action: Take no action on the results.

1) Automated Action: Select to apply the action automatically.

g. Ignore: Ignore all future instances of a result.

1) Automated Action: Select to apply the action automatically.

To complete a select action section:

1. In an existing action, click the plus icon below the action box.

2. Select Completed.

3. The action is marked Complete.

4. To reopen the action, click the X to the right of Complete.

In an existing action, you can add further decision flow below or action to the side:

1. New Decision:

a. Click the plus icon at the bottom of the current action.

b. Click Decision.

c. Write the new step logic as defined in the Decision Point section.

d. Select an action from the Select Action drop-down list. See Select Action for more details.

2. New Adjacent Action:

a. Click the plus icon to the side of the current action.

b. Select an action from the Select Action drop-down list. See Select Action for more details.

c. To delete the new adjacent action, click the trash icon.

Note: To use a Playbook, you must mark all actions complete.

The Manage Quarantine Paths screen allows you to set a specific quarantine path other than the default setting. To manage a quarantine path:

1. In a playbook, click Actions then Manage Quarantine Paths.

2. In the Quarantine Paths pop-up window, select one or more options from the drop-down list.

3. Click outside of the drop-down list.

4. Fill in the selected file paths.

5. Click Save to save settings or Cancel to discard.

The Select Data Types pop-up window lists all the existing data types and actions you can take. Expand a section for more information:

1. In a playbook, click Actions then Manage Data Types.

2. Do one of the following:

  • Select a data type tile.

  • Type a data type in the search box and select the tile.

3. Click Confirm to select this data type or Cancel to discard.

To edit a data type:

1. Click a data type tile. For example, Social Security Number.

2. In the Edit Data Type pop-up window, make needed changes.

3. Click Save & Update to save your changes or Cancel to discard.

4. Click Confirm to update the data type or Cancel to discard.

The Classification screen displays a searchable list of existing classifications. You can view, edit, and add classifications on the screen. See Global Classifications for more information.

The Script Repository screen displays a searchable list of existing scripts. You can view, export, delete, and add new scripts. See Working with Script Repository for more information.