O365 securlet response actions mapped to DLP response actions

Products

• CASB Advanced Threat Protection
• CASB Security Advanced
• CASB Security Premium
• CASB Security Standard
• CASB Securlet SAAS
• CASB Securlet SAAS With DLP-CDS
• Data Loss Prevention
• Data Loss Prevention Cloud Detection Service for REST
• Data Loss Prevention Cloud Package

Issue/Introduction

Reference this table to see the 0365 securlet response actions mapped to DLP and the affect on o365.

Resolution

Securlets	Enforce Payloads	CASB Remediation	DLP Remediation	DLP Custom payload /Dropdown	OneDrive	Sharepoint	O365 email	MS Teams	Legacy (Python) Behaviour	Proposed(Go) Remediation Behaviour
Remediation Supported	breaklinks	Remove shared link	Remove Shared Links in DAR	Dropdown	Yes	Yes	N/A	N/A	Removes public and org link Removes Everyone, Everyone Except External users direct sharing	Removes public and org link Removes Everyone Except External users direct sharing Also, if file is inheriting permissions from parent folder then shared link will also remove from the parent folder
Type of Exposures					Public Internal	Public Internal
Remediation Supported	quarantine	Move/Copy/Move with Tombstone	Quarantine DAR (Move & Move with tombstone)	Both	Yes	Yes	N/A	N/A
Type of Exposures					Unexposed Public Internal External	Unexposed Public Internal External
Remediation Supported	encrypt	From Protect Policy-> select "Encryption" option	Encrypt DAR	Dropdown	Yes	Yes	N/A	N/A		Not supported yet
Type of Exposures					Unexposed Public Internal External	Unexposed Public Internal External
Remediation Supported	file_access_all_read	Everyone can read	Set File Access to 'All Read'	Both	Yes	Yes	N/A	N/A	Removed Everyone Except External users, public links Adds Everyone with Read access External users and internal users access not impacted.	Adds "Everyone except external users can read"
Type of Exposures					Unexposed Public Internal External	Unexposed Public Internal External
Remediation Supported	file_access_internal_edit	Everyone except external users can edit	Set File Access to 'Internal Edit'	Both	Yes	Yes	N/A	N/A	Removes Public link, Org link but not Users link Adds Everyone Except external users to Edit External users and internal users access not impacted.	Adds "Everyone except external users can edit"
Type of Exposures					Unexposed Public Internal External	Unexposed Public Internal External
Remediation Supported	file_access_internal_read	Everyone except external users can read	Set File Access to 'Internal Read'	Both	Yes	Yes	N/A	N/A	Removes Public link, Org link but not Users link Adds Everyone Except external users to Read External users and internal users access not impacted.	Adds "Everyone except external users can read"
Type of Exposures					Unexposed Public Internal External	Unexposed Public Internal External
Remediation Supported	collab_access_read	Collaborator access change to read	Set Collaborator Access to 'Read'	Both	Yes	Yes	N/A	N/A	Only for external users, shared with direct access Not changing to Read, when shared as a link	Role change is only applied to the external users added through direct access
Type of Exposures					External	External
Remediation Supported	collab_access_edit	Collaborator access change to Edit	Set Collaborator Access to 'Edit'	Both	Yes	Yes	N/A	N/A	Only for external users, shared with direct access Not changing to edit, when shared as a link	Role change is only applied to the external users added through direct access
Type of Exposures					External	External
Remediation Supported	collab_access_remove	Remove external collaborator	Remove Collaborator Access	Both	Yes	Yes	N/A	N/A	Removes only external. Internal will be removed only if its shared as a link along with external user (as there is common link for both internal and external user)	Removes only external collabs Internal will be removed only if its shared as a link along with external user (as there is common link for both internal and external user) Also, if file is inheriting permissions from parent folder then external collab will also remove from parent folder(only link sharing, not direct access)
Type of Exposures					External	External
Remediation Supported	Selective_collab_access_remove	Select external user in file shared with field and select remove external collabl in the CASB policy	Yes	Custom payload	Yes	Yes	N/A	N/A
Type of Exposures					External	External
		v
Remediation Supported	Tag Data-at-Rest (MIP Tag)	N/A	Yes	Custom payload	Yes	Yes	N/A	N/A
Type of Exposures					Unexposed Public Internal External	Unexposed Public Internal External
Remediation Supported	Smart response rule	N/A	Restore	Dropdown	Yes	Yes	N/A	N/A
Type of Exposures					Unexposed Public Internal External	Unexposed Public Internal External				Direct access sharing will be restored **
Remediation Supported	RESET_PERMISSIONS	Delete unique permissions	N/A	N/A	Yes	Yes	N/A	N/A	Removes permission from file or immidiate parent folder	Removes permission from file or permission inheriting parent folder
Type of Exposures					Public Internal External	Public Internal External
Remediation Supported (Mail only)	delete	Delete Attachment permanently/Delete Email	Delete DAR	Dropdwon	N/A	N/A	Yes	N/A		Delete mail with or wihtout attachment is supported. Delete only mail attachment is not supported
Type of Exposures							External Unexposed
Remediation Supported (Teams only)	BlockAccess	N/A	Yes	Custom payload	N/A	N/A	N/A	Yes
Type of Exposures								Unexposed External
Remediation Supported (Teams only)	NotifySender	N/A	Yes	Custom payload	N/A	N/A	N/A	Yes
Type of Exposures								Unexposed External

 

DLP DAR remediations not applicable to O365

Perform DRM on Data-at-Rest

Prevent - download ,copy, print

collab_access_preview

ICT Classification and Tagging Data-at-Rest

** Restore exposure is only enabled through param in tenant_app_params