Scans Settings

 

 

Overview

Scans Settings is where you manage your settings for:

  • Scan Item Number and Load

  • Target Preferences

  • Remediation Settings

  • Policy and Application Updates

  • Notifications and Custom Notifications

  • Data Retention

    Note: Changes to Settings values take effect the moment data is entered into any field.
    You may wish to retain a copy of the original settings when making updates if you need to revert back to the previous settings.

 

Access Scan Settings

To access the Scan Settings screen, use the following steps:

 

  1. From the left menu, click Settings.


  2. Click Application Settings.

  3. To view sections in the Scans Settings:

    1. Click a down arrow to expand a section.

    2. Click an up arrow to collapse a section.

 

Manage Scan Settings

To manage Scan Settings, use the following steps:

  1. Click the down arrow to expand the section.

  2. Fill in the following settings:

    1. Minimum Load When Using Distributed Scanning (MB): Enter a minimum scans number in megabytes.

    2. Minimum Number of Items When Using Distributed Scanning: Enter a minimum number of items to use.

    3. Maximum Load When Using Distributed Scanning (MB): Enter a maximum scans number in megabytes.

    4. Maximum Number of Items When Using Distributed Scanning: Enter a maximum number of items to use.

      Note: If a distributed scan is not completing when run against a very large data set, you will need to set the thresholds to a minimum of 5 MB and a maximum of 10 MB and run the scan again.

      Contact your Customer Success Manager if you have any questions.

Manage Agents Settings

To manage Agents settings:

  1. Click the down arrow to expand the section.

  1. Agent Search Progress Update Intervals: Enter an interval setting.
  2. Keep Agent Activity State History: Select, if applicable.
  3. Automatically Merge Agents Based on: Select all applicable:
    1. Disable
    2. Hostname
    3. Mac Address
    4. IP Address
    5. All
  4. Inherit Permissions on Targets from Filter/IP Tags: Select, if applicable.

Manage Remediation Settings

Global quarantine configurations for cloud locations are mostly done with the admin accounts.

Note: Global configurations can be overridden by Playbook quarantine locations.

To manage Remediation settings, use the following steps:

  1. Click the down arrow to expand the section.
  2. Synchronize Classification Changes With Targets: Select, if applicable.

  3. Classification Overlay Shape: Select an option from the drop-down list.

  4. Use This Algorithm When Creating File Hashes: Select an option from the drop-down list.

Linux Quarantine File Path

Enter the Linux location to quarantine the files.

  • Local Agent machine, all files: <path>/<Quarantine_Folder>

    • Example: /home/AdminBob/Quarantine

    • This entry quarantines all files to the specified Linux folder on the local Agent machine

  • Mounted machine, all files: mnt/Quarantine

    • This entry quarantines all files to the specified Linux folder on the specified mounted machine

  • Remote machine, all files: \\<IP_address>\<drive_letter>$\<Quarantine_Folder>

    • Example: \\10.0.2.163\c$\Quarantine

    • This entry quarantines all files to the specified path on the specified remote Windows machine

    Note: The file path syntax for Linux and Mac is different from that of Windows. The '\' character in Windows is represented as '/' in Linux/Mac.

Mac Quarantine File Path

Enter the Mac location to quarantine the files.

  • Local Agent machine, all files: <path>/<Quarantine_Folder>
    • Example: /Users/Admin/Quarantine
    • This entry quarantines all files to the specified Mac quarantine folder on the local Agent machine
  • Remote machine, all files: \\<IP_address>\<drive_letter>$\<Quarantine_Folder>
    • Example: \\10.0.2.163\c$\Quarantine
    • This entry quarantines all files to the specified path on the specified remote Windows machine

Windows Quarantine File Path

Enter the local or remote Microsoft Windows location to quarantine the files.

  • Local Agent machine, all files: <Drive_Letter>:\<Quarantine_Folder>
    • Example: C:\ScanData\Quarantine
    • This entry quarantines all files to the specified Windows drive (C:) and folder on the local Agent machine
  • Remote machine, all files: \\<IP_address>\<drive_letter>$\<Quarantine_Folder>
    • Example: \\10.0.2.163\c$\Quarantine
    • This entry quarantines all files to the specified path on the specified remote Windows machine

Leave Behind Warning Text Content

  • Enter a text message that displays on files specifying the reason of quarantine.

Redact Character Replacement

  • Enter the character you want to use in place of the text you are redacting.

Redact all but Last 4

  • Select, if applicable.

Note: The format of a default quarantine location is <user@domain.com>/<Quarantine_Folder>, <admin account> where user@domain.com is the user account of the cloud location, Quarantine_Folder is the path to the quarantine folder and admin account (optional) is the administrative account and is used to quarantine only the files in the admin account.

For example, the Google Drive quarantine file path can be john.doe@spirion.com/Quarantine.

Global quarantine configurations for cloud locations are mostly done with the admin accounts.
Also, global configurations can be overridden by Playbook quarantine locations.

Amazon S3 Quarantine File Path

Specify the default folder to use for quarantining files discovered in an Amazon S3 cloud location.

  • This setting can be a single location or a list of locations, entered one per line.

  • Each item in the list must be specifically formatted to include the <path>, <user account> (optional), or <admin account> (admin account optional)

    • <path> is any valid path

    • <user account> is a specified S3 user account to the specified S3 location

    • <admin account> (optional) is an administrative account on S3 defined in the cloud storage configuration.

      • If the admin account is not included, the path applies to all administrative accounts defined in the configuration.

  • Supported Paths

    • Only cloud storage paths (as they appear in results without a file name)

Examples

Examples of quarantine paths for local and cloud destinations, in valid formats, are listed below:

  • Amazon S3, all files: user@domain.com/Quarantine_Folder

    • This entry quarantines all files on this cloud provider to the specified Amazon S3 quarantine folder

  • Amazon S3, admin user files only: user@domain.com/Quarantine_Folder,admin@domain.com

    • This entry quarantines only files in the specified admin account on this cloud provider to the specified Amazon S3 quarantine folder

Box Quarantine File Path

Specify the default folder to use for quarantining files discovered in a Box cloud location.

  • This setting can be a single location or a list of locations, entered one per line.

  • Each item in the list must be specifically formatted to include the <path>, <user account> (optional), or <admin account> (admin account optional)

    • <path> is any valid path

    • <user account> is a specified Box user account to the specified Box location

    • <admin account> (optional) is an administrative account on Box Sync defined in the cloud storage configuration.

      • If the admin account is not included, the path applies to all administrative accounts defined in the configuration.

  • Supported Paths

    • Only cloud storage paths (as they appear in results without a file name)

    • Standard file system paths

Examples

Examples of quarantine paths for local and cloud destinations, in valid formats, are listed below:

  • Local Agent machine, all files: E:\Quarantine_Folder

    • This entry quarantines all files on this cloud provider to this local folder (E:\Quarantine_Folder) on the local agent

  • Local Agent machine, admin user files only: E:\Quarantine_Folder,admin@account.com

    • This entry quarantines only files in the specified admin account on this cloud provider to this folder (E:\Quarantine_Folder) on the local agent

  • Box, all files: Box Sync: user@account.com/Quarantine_Folder

    • This entry quarantines all files on this cloud provider to the specified Box Sync folder

  • Box, admin user files only: Box Sync Admin: user@account.com/Quarantine_Folder,admin@account.com

    • This entry quarantines only files in the specified admin account on this cloud provider to the specified Box Sync folder

Dropbox Quarantine File Path

Specify the default folder to use for quarantining files discovered in a Dropbox cloud location.

  • This setting can be a single location or a list of locations, entered one per line.

  • Each item in the list must be specifically formatted to include the <path>, <user account> (optional), or <admin account> (admin account optional)

    • <path> is any valid path

    • <user account> is a specified Dropbox user account to the specified Dropbox location

    • <admin account> (optional) is an administrative account on Dropbox Sync defined in the cloud storage configuration.

      • If admin account is not included, the path applies to all administrative accounts defined in the configuration.

  • Supported Paths

    • Only cloud storage paths (as they appear in results without a file name)

    • Standard file system paths

Examples

Examples of quarantine paths for local and cloud destinations, in valid formats, are listed below:

  • Local Agent machine, all files: E:\Quarantine_Folder

    • This entry quarantines all files on this cloud provider to the specified drive and folder (E:\Quarantine_Folder) on the local agent

  • Local Agent machine, admin user files only: E:\Quarantine_Folder,admin@account.com

    • This entry quarantines only files in the specified admin account on this cloud provider to the specified drive and folder (E:\Quarantine_Folder) on the local agent

  • Dropbox, all files: Dropbox Sync: user@account.com/Quarantine_Folder

    • This entry quarantines all files on this cloud provider to the specified Dropbox Sync folder

  • Dropbox, admin user files only: Dropbox Sync: user@account.com/Quarantine_Folder,admin@account.com

    • This entry quarantines only files in the specified admin account on this cloud provider to the specified Dropbox Sync folder

Microsoft OneDrive Quarantine File Path

Specify the default folder to use to quarantine files discovered in a Microsoft OneDrive cloud location.

  • This setting can be a single location or a list of locations, entered one per line.

  • Each item in the list must be specifically formatted to include the <path>, <user account> (optional), or <admin account> (admin account optional)

    • <path> is any valid path to the files to be quarantined

    • <user account> is a specified OneDrive user account to the specified OneDrive location

    • <admin account> is an administrative account on OneDrive defined in the cloud storage configuration.

      • If the admin account is missing, the path applies to all administrative accounts defined in the configuration.

  • Supported Paths

    • Cloud storage paths (as they appear in results without a file name)

    • Standard file system path

Examples

Examples of quarantine paths for local and cloud destinations, in valid formats, are listed below:

  • Local Agent machine, all files: E:\Quarantine_Folder

    • This entry quarantines all files on this cloud provider to the specified drive and folder (E:\Quarantine_Folder) on the local agent

  • Local Agent machine, admin user files only: E:\Quarantine_Folder,admin@account.com

    • This entry quarantines only those files in the specified admin account on this cloud provider to the specified drive and folder (E:\Quarantine_Folder) on the local agent

  • OneDrive, all files: OneDrive For Business: user@domain.com/Quarantine_Folder

    • This entry quarantines all files on this cloud provider to the specified Microsoft OneDrive for Business quarantine folder

  • OneDrive, admin user files only: OneDrive For Business: user@domain.com/Quarantine_Folder,admin@account.com

    • This entry quarantines only files in the specified admin account on this cloud provider to the specified Microsoft OneDrive for Business quarantine folder

Note: To quarantine files to Microsoft OneDrive, the entire location path must be written in lowercase.

Google Drive Quarantine File Path

Specify the default folder to use to quarantine files discovered in a Google Drive cloud location.

  • This setting can be a single location or a list of locations, entered one per line.

  • Each item in the list must be specifically formatted to include the <path>, <user account> (optional), or <admin account> (admin account optional)

    • <path> is any valid path

    • <user account> is a specified OneDrive user account to the specified OneDrive location

    • <admin account> is an administrative account on Google Drive defined in the cloud storage configuration.

      • If the admin account is missing, the path applies to all administrative accounts defined in the configuration.

  • Supported Paths

    • Cloud storage paths (as they appear in results without a file name)

    • Standard file system path

Examples

Examples of quarantine paths for local and cloud destinations, in valid formats, are listed below:

  • Local Agent machine, all files: E:\Quarantine_Folder

    • This entry quarantines all files on this cloud provider to the specified drive and folder (E:\Quarantine_Folder) on the local agent

  • Local Agent machine, admin user files: E:\Quarantine_Folder,admin@account.com

    • This entry quarantines only those files in the specified admin account on this cloud provider to the specified drive and folder (E:\Quarantine_Folder) on the local agent

  • Google Drive, all files: Google Drive: user@domain.com/Quarantine_Folder

    • This entry quarantines all files on this cloud provider to the specified Google Drive quarantine folder

  • Google Drive, admin user files only: Google Drive: user@domain.com/Quarantine_Folder,admin@account.com

    • This entry quarantines only those files in the specified admin account on this cloud provider to the specified Google Drive quarantine folder

SharePoint Quarantine File Path

Enter the SharePoint location to quarantine the files.

Note: Quarantining SharePoint files to a remote file server is not supported at present.

  • Local Agent machine: <Drive_Letter>:\Quarantine_Folder
    • For example, C:\SharePointQuarantine
    • This entry quarantines all files to the specified drive (C:) and quarantine folder on the local Agent machine
  • SharePoint site: https://<SharePoint_site>/QuarantineSite
    • For example, https://acmedev.sharepoint.com/sites/QuarantineSite
    • This entry quarantines all files to the specified SharePoint site quarantine folder on the specified remote SharePoint quarantine site

Bitbucket Quarantine File Path

Bitbucket is not currently supported.

 

Microsoft Information Protection

In the Manage Protection (Authenticated)

  1. Click Manage.
  2. The Manage Protection window opens.



In the Manage Protection window, enter these settings:

  • Admin User Account Name: Enter your admin user account name and click Authenticate.
  • Authentication Code: Enter your authentication code provided from the authentication above in the box.
  • Client ID: (Optional) Enter your unique client ID to be used for authentication.
  • Client Secret: (Optional) Enter your unique client secret to be used for authentication.
  • Tenant ID: (Optional) Enter your tenant ID to be used by the authenticating server.

  1. Click Save to save or Cancel to discard.

Note: If you enter value in any of the optional fields, it is mandatory to add values in the other optional fields as well.

In the Manage Label (Authenticated) section, do the following:

  1. Click Manage.

In the Manage Label pop-up window, fill in the following:

  • Admin User Account Name: Enter your admin user account name (user@domain.com) and click Authenticate.
  • Authentication Code: Enter your authentication code provided from the authentication above in the box.
  • Client ID: Enter your unique client ID to be used for authentication.
  • Client Secret: Enter your unique client secret to be used for authentication.
  • Tenant ID: Enter your tenant ID to be used by the authenticating server.

  1. Click Save to save or Cancel to discard.

Manage Updates Settings

Use the following steps to manage your Updates Settings:

  1. Click the down arrow to expand the section.
  2. Check This URL for Policy Definitions Updates: Enter the URL that hosts your Policy Definitions.
  3. Automatically Check for Updates When Resources Page is Loaded for the First Time: Select, if applicable.

  4. Check This URL for Application Updates: Enter the URL that hosts your Application Updates.

Manage Notifications Settings

To manage Notifications Settings:

  1. On the left of the Notifications row, click the down arrow to expand the section.

  2. In the Purge Notifications section, select an option from the "Purge Dismissed Notification After" drop-down list.



  3. In the Custom Notification section, you can manage existing custom notifications or create new ones.

Manage a Custom Notification

To manage custom notifications, use the following steps:

  1. Locate a template in the list.
  2. Use the toggle to change the deployed status.

  3. To manage a template, click the more options menu.

  4. Click Manage.

  5. In the Manage Custom Notification pop-up window, make needed changes.

  6. Click Update to save updates, Cancel to discard updates, or Delete to delete the template.

Note: If you click the Delete button, it immediately deletes the template. There is no undo feature.

Create a New Template

Procedure:

  1. In the Custom Notifications section, click New Template.

  2. In the Create Custom Notification pop-up window, fill in the following:
    1. Name: Enter the template name.
    2. Subject: Enter a description of the template subject.
    3. Active: Use the toggle to change the Active status.

  3. Body: Use the text editor to compose the body of the template.
    1. Use the toolbar to format the text and paragraphs, and to insert code and variables as needed.

  4. Click Save to save the template or Cancel to discard.

Manage Data Retention Settings

To manage your Data Retention settings, fill in the following fields:

  • Audit Data Retention:
    • Set the number of years to retain data.
    • A minimum of five years is required.
  • Gather Data Retention:
    • Set the number of days to gather data.
    • This number must be between 1 and 30 days.
  • Scan Results Retention:
    • Set the number of months to retain scan results.
    • This number must be between 1 and 12 months.
  • Event History - Watcher:
    • Set the number months for the Watcher Event History, if applicable.
  • Activity History:
    • Set the number to set the number of months in the Incident History.
    • A minimum of 12 months is required.
  • Search History
    • Set the number of months to retain the history of scanned locations when using Differential Scan.
    • After this set number of months, search history data is purged (deleted).
    • This number must be between 1 and 12 months.