REST Action Failed Received When Removing Document Links Via Response Rule

Products

• Data Loss Prevention Cloud Detection Service
• Data Loss Prevention
• Data Loss Prevention Cloud Detection Service for REST
• CASB Securlet SAAS

Issue/Introduction

A user shares a collaborator link with an external user. The shared file contains sensitive information.

External in this context is a person outside the CASB Tenant's Primary or Secondary Domains.
 

Incident Details: REST Action Failed

Environment

DLP 15.X
CASB Securelet: Microsoft O365 OneDrive

Cause

The correct response rules required to remove access or break links may be missing from the policy.

Resolution

The Data-At-Rest Response rule, "Remove Shared Links in Data-at-Rest" is used when a document is exposed publically, or externally, and the link needs to be removed.
The Data-At-Rest Response rule, "Remove Collaborator Access" can be used to remove collaborator links on files shared with persons identified as external, even when the file itself IS NOT exposed externally.

To be able to remove links for both use cases, an Automated Response Rule for each action should be added to the policy. Alternatively, an Automated Response Rule containing both response rules can be used.