This guide will walk you through the process of setting up a policy to automatically remove or quarantine malware found in your environment.
STEP ONE:
Sign into your Cloud Access Monitor Instance.
STEP TWO:
Select the "x Enabled" policies button to the right of the desired Cloud Environment.
STEP THREE:
Enter your Email you wish to receive alerts to.
STEP FOUR:
Select the "Add Policy" Button on the bottom right of the screen.
STEP FIVE:
The Add Policy window will appear.
Give your policy a Name.
Select the Source(s) you would like to enforce the policy on.
Select File type(s), blank (all) is recommended.
Select File Size, blank (all) is recommended.
STEP SIX:
Select Malware in the Threats column.
STEP SEVEN:
Select if you would like the policy to apply to Suspicious or Malicious files.
STEP EIGHT:
Once you have setup your custom policy select the Apply"button on the bottom left.
STEP NINE:
At this point you may choose if you would like any Automatic Remediation to take place. Each source has its own remediation options.
Drive:
Delete Files: Will delete the file from the drive.
Quarantine Files: Will place the file into a safe location until it can be further examined
Revoke Sharing From Outside Domain: Will remove the share if it is coming from an outside domain.
Send Warning: Will send the user a warning informing them that malware was found in their drive.
Email:
Delete Email: This will delete the e-mail as soon as it is found to contain risk.
Trash Email: Will move the e-mail into the users trash folder
Send Warning: Will send the user a warning informing them that malware was found in their email.
STEP TEN:
Once you have chosen your remediation options (if any), the next step is to choose when remediation options will occur.
Immediately: The action will occur as soon as the policy is violated.
After 1 Day: In 24 Hours the remediation will occur.
After 3 Days: In three days the remediation will occur.
After 1 Week: In one week the remediation will occur.
After 2 Weeks: In two weeks the remediation will occur
STEP ELEVEN:
Choose who will be notified if a remediation does occur.
Notify User: Notify the user that caused the policy violation to occur.
Notify Admin: Notify the Cloud Access Monitor Admin of the infraction.
STEP TWELVE:
Select the save button at the bottom right of the window.
NOTE:
Enable / Disable: To enable or disable a policy, simply click the enable button found on the policy window.
Edit: To edit an existing policy click the edit pencil on the right side of the policy window.
Delete: To delete a policy, simply click the trash can icon on the right side of the policy window.