Working with Scan Playbooks

• Overview

• Access and View Scan Playbooks

• Search for a Scan Playbook

• Add a Scan Playbook

• Create a Bulk Export of Scan Playbooks

• Manage a Scan Playbook

• Export a Scan Playbook

• Clone a Scan Playbook

• Delete a Scan Playbook

• Manage Classification for a Scan Playbook

• Manage Quarantine Path for a Scan Playbook

 

Overview

The Scan Playbooks page is where you view and manage your Playbooks.

Playbooks, at a high-level, provide logical workflows using interactive flowchart symbols for the discovery, classification, notification, and remediation of sensitive data.

 

 

Playbook Actions

It's important to remember Playbooks define:

• The logic for sensitive data scans

• The actions to take when data matches are found. See the graphic below.

• For more about playbook actions, see Add a New Scan Playbook/Select Action

  
  

Playbook Actions

 

Access and View Scan Playbooks

To access this screen:

1. From the left menu, click Scans.
   
   

2. Click Scan Playbooks.
   
   

Scan Playbooks are displayed in a list sorted by column:

• Playbook Name (Rule)

• Description

• Last Opened

• Last Edited

• More options
  
  

3. Click a column to sort ascending.
   
   

4. Click the column again to sort descending.
   
   

Search for a Scan Playbook

You can search for a Playbook by:

• Playbook Name (Rule)
• Description
  
  

Procedure:

1. Type the search query in the box and the results are sorted and displayed in the table below.
   
   

2. Click the x to clear the search term.

Add a Scan Playbook

To add a Scan Playbook:

1. In the top right of the screen, click Add Playbook.
   
   

See Add a New Scan Playbook for how to proceed.

Create a Bulk Export of Scan Playbooks

To export multiple playbooks:

1. Select one or more playbooks from the playbooks list

2. Click Bulk Actions.
   
   

3. Click Export.

4. The playbooks file is downloaded to your local computer.
   
   

Manage a Scan Playbook

To manage a Scan Playbook:

1. Locate a playbook in the Playbooks list.

2. In the far right column, click the ellipse menu.
   
   

3. Click Manage Playbook.
   
   

4. In the playbook detail page, make needed changes.
   

5. Click the save icon in the top left of the screen.
   
   
   

6. See Add a New Scan Playbook for more information on creating playbooks.

 

Export a Scan Playbook

To export a playbook:

1. Locate a playbook in the Playbooks list.

2. In the far right column, click the more options menu.
   
   

3. Click Export Playbook.
   
   

4. The playbook file is downloaded to your local computer.
   
   

Clone a Scan Playbook

To clone a Scan Playbook:

1. Locate a playbook in the Playbooks list.

2. In the far right column, click the ellipse menu.
   
   

3. Click Clone Playbook.
   
   

4. In the Clone Playbook page, enter the name of the new playbook and click OK.
   
   

Delete a Scan Playbook

To delete a playbook:

1. Locate a playbook in the Playbooks list.

2. In the far right column, click the more options menu.
   
   

3. Click Delete Playbook.
   
   

4. Click Confirm to delete or Cancel to discard.
   
   
   

Manage Classification for a Scan Playbook

To manage classification for a scan playbook:

1. Locate a playbook in the Playbooks list.

2. In the far right column, click the ellipse menu.
   
   

3. Click Manage Playbook.
   
   

4. Click Actions and then Manage Classification.

5. Access Global Classifications for further information on Classifications.
   
   

Manage Quarantine Path for a Scan Playbook

To manage quarantine path for a scan playbook:

1. Locate a playbook in the Playbooks list.

2. In the far right column, click the ellipse menu.
   
   

3. Click Manage Playbook.
   
   

4. Click Actions and then Manage Quarantine Paths
   
   
   

5. In the Quarantine Paths dialog, select one or more environment.

6. Enter the desired quarantine file path for each selected environment.

   Note: Playbook quarantine locations override the global quarantine configuration.
   
   Multiple quarantine paths separated by a comma can be entered per environment.

   Note: UNC paths are supported for workstations and remote file servers, and standard file system.
   
   Cloud targets can also quarantine to cloud locations.
   
   For example, with a Google Cloud target the following paths would be valid:
   
   • C:\Quarantine_Folder - This entry would cause all files on this target to be quarantined to a folder on the agent host system performing the scan.
   • \\RemoteServer\Quarantine_Folder - This entry would cause all files to be quarantined to a remote folder.
   • Google Drive: user@account.com/Quarantine_Folder - This entry would cause all files on this cloud provider to be quarantined to a specified Google Drive folder.

   Note: To quarantine files to Microsoft OneDrive, the entire location path must be written in lowercase.
   
   For example, OneDrive paths must be formatted exactly as:
   
   • Microsoft OneDrive: user@domain.com/quarantinefolder

7. Click Confirm.