Create Slack policies in CloudSOC based on the Slack Channel

Products

• CASB Securlet SAAS
• CASB Security Advanced
• CASB Security Premium
• CASB Security Standard
• CASB Securlet SAAS With DLP-CDS

Issue/Introduction

You want to create CloudSOC DLP Policies for Slack Securlet, based on the Slack ID or Slack Name. 

Resolution

For Slack messages, the resource id contains channel id. Therefore you can create policies matching the content AND a Contextual Rule for common.doc.id and use regex to match the Slack channel id. For instance, you can create a keyword matching rule, and then use the doc.id rule looking for the anything contains the channel id C0..... using the regualr expression .*ID.*

For files, there is another contextual attribute common.shareWithList, so you can use this to look for files uploaded to a specific channel: