How to Detokenize CSV from Tokenized CloudSOC account

book

Article ID: 184484

calendar_today

Updated On:

Products

CASB Security Standard CASB Security Premium CASB Security Advanced CASB Audit CASB Gateway CASB Gateway Advanced Data Loss Prevention Cloud Package

Issue/Introduction

Customers will occasionally Tokenize their SpanVA data coming to CloudSOC. 

A customer may still want to download a CSV of their Risky Users. Since the data is tokenized, the CSV will be unreadable. 

Resolution

There is a SpanVA Detokenizer tool. 

This information is found in the Tech Note 'Installing and Configuring SpanVA'. Starting on page 72

Using SpanVA detokenization
When you have SpanVA tokenization enabled, the .CSV files you download via email from the
Audit app have the user IDs tokenized, so you cannot correlate between activities in the file and
actual user IDs. SpanVA has a tool that you can use to detokenize the emailed .CSV files and
match users with activities from your device logs.
In order to use this feature:
● SpanVA tokenization must be enabled
● CloudSOC anonymization must be disabled
● The currently selected Audit datasources must be limited to those uploaded to CloudSOC
through SpanVA
1. In CloudSOC, choose Audit > Users or Audit > Services .
2. Near the upper left corner of the page, click Select Sources and enable only sources that
use SpanVA, then click Save .
3. On the Users tab, Click Export CSV , then click Email CSV as shown below.
Copyright © 2018 Symantec Corp. Confidential Information. Do Not Distribute. 59
Tech Note — Installing and Configuring SpanVA
CloudSOC processes the data in the tab and emails you a download link for the CSV file
as shown below.
4. Click the link to login to CloudSOC (if you are not already logged in) and download the
CSV file in your browser.
5. After you receive the CSV from CloudSOC, open the SpanVA web interface and log in.
Then click the Detokenization tab.
6. On the tab, either drag the CSV file to the Drag & Drop box as shown below or click the
box and navigate to the file.
Copyright © 2018 Symantec Corp. Confidential Information. Do Not Distribute. 60
Tech Note — Installing and Configuring SpanVA
7. Click Convert the Selected File .
SpanVA detokenizes the file and then displays a download button for the file. Click
Download to download the detokenized file in your browser. The Detokenization page
shows the five most recent detokenized files.