Data-in-Motion Response Rules are not working for your Cloud Detection Service for CASB

Products

• Data Loss Prevention Cloud Detection Service
• Data Loss Prevention Cloud Detection Service for REST
• Data Loss Prevention

Issue/Introduction

In addition to the list of pre-configured Response Rules, several types of Response Rules are given for the DLP Cloud Detection Service.

Environment

All Enforce Servers where the DLP Cloud Detection Service is registered, for integration with the CloudSOC, specifically.

Cause

There are several Data-in-Motion Response Rules available in the Enforce Server but these do not all appear to work.

Resolution

We have confirmed that the documentation for this feature needs updating. Therefore, several of the options outlined in the following pages are incorrect:

Configuring response rule actions (broadcom.com)

As far as we know, only 2 of these Data-in-Motion actions are valid when configuring rules for Data-in-Motion (aka - for CloudSOC Gatelets):

• Configuring the Add two-factor authentication action (broadcom.com)
• Configuring the Block Data-in-Motion action

 

The following ones, however, are not:

• Configuring the Custom Action on Data-in-Motion action
• Configuring the Encrypt Data-in-Motion action
• Configuring the Perform DRM on Data-in-Motion action
• Configuring the Quarantine Data-in-Motion action
• Configuring the Redact Data-in-Motion action

Additional Information

A defect has been filed with the team to have the documentation at the above pages updated, DLP-67904.