Working with Scan Playbooks

 

Overview

The Scan Playbooks screen is where you view and manage your Playbooks.

 

It's important to remember Playbooks define:

  • The logic for sensitive data scans.

  • The actions to take when data matches are found. See the graphic below:

Playbook Actions

 

Expand a section for more information:

Access and View Scan Playbooks

To access this screen:

  1. From the left menu, click Scans.

  1. Click Scan Playbooks.

Scan Playbooks are displayed in a list sorted by column:

  • Playbook Name (Rule)

  • Description

  • Last Opened

  • Last Edited

  • More options

  1. Click a column to sort ascending.

  1. Click the column again to sort descending.

Search for a Scan Playbook

You can search for a Playbook by:

  • Playbook Name (Rule)
  • Description

  1. Type the search query in the box and the results are sorted and displayed in the table below.

  2. Click the x to clear the search term.

Add a Scan Playbook

To add a Scan Playbook:

  1. In the top right of the screen, click Add Playbook.

See Add a New Scan Playbook for how to proceed.

Create a Bulk Export of Scan Playbooks

To export multiple playbooks:

  1. Select one or more playbooks from the playbooks list

  2. Click Bulk Actions.

  3. Click Export.

  4. The playbooks file is downloaded to your local computer.

To manage a Scan Playbook:

  1. Locate a playbook in the Playbooks list.

  2. In the far right column, click the ellipse menu.

  3. Click Manage Playbook.

  4. In the playbook detail page, make needed changes.

  5. Click the save icon in the top left of the screen.

  6. See Add a New Scan Playbook for more information on creating playbooks.

 

To export a playbook:

  1. Locate a playbook in the Playbooks list.

  2. In the far right column, click the more options menu.

  3. Click Export Playbook.

  4. The playbook file is downloaded to your local computer.

To clone a Scan Playbook:

  1. Locate a playbook in the Playbooks list.

  2. In the far right column, click the ellipse menu.

  3. Click Clone Playbook.

  4. In the Clone Playbook page, enter the name of the new playbook and click OK.

To delete a playbook:

  1. Locate a playbook in the Playbooks list.

  2. In the far right column, click the more options menu.

  3. Click Delete Playbook.

  4. Click Confirm to delete or Cancel to discard.

To manage classification for a scan playbook:

  1. Locate a playbook in the Playbooks list.

  2. In the far right column, click the ellipse menu.

  3. Click Manage Playbook.

  4. Click Actions and then Manage Classification.

  5. Access Global Classifications for further information on Classifications.

To manage quarantine path for a scan playbook:

  1. Locate a playbook in the Playbooks list.

  2. In the far right column, click the ellipse menu.

  3. Click Manage Playbook.

  4. Click Actions and then Manage Quarantine Paths


  5. In the Quarantine Paths dialog, select one or more environment.

  6. Enter the desired quarantine file path for each selected environment.

Note: Playbook quarantine locations override the global quarantine configuration.

Multiple quarantine paths separated by a comma can be entered per environment.

Note: UNC paths are supported for workstations and remote file servers, and standard file system.

Cloud targets can also quarantine to cloud locations.

For example, with a Google Cloud target the following paths would be valid:

• C:\Quarantine_Folder - This entry would cause all files on this target to be quarantined to a folder on the agent host system performing the scan.
• \\RemoteServer\Quarantine_Folder - This entry would cause all files to be quarantined to a remote folder.
• Google Drive: user@account.com/Quarantine_Folder - This entry would cause all files on this cloud provider to be quarantined to a specified Google Drive folder.

Note: To quarantine files to Microsoft OneDrive, the entire location path must be written in lowercase.

For example, OneDrive paths must be formatted:

• Microsoft OneDrive: user@domain.com/quarantinefolder
• "Microsoft OneDrive:" then exactly one space, then "user@domain.com/quarantinefolder".

  1. Click Confirm.