Applying Notification Policies for CASB

The following are suggested templates that can be used to notify the Admin team and end users.

For more details about notification policies, see Creating a Notification Policy for a Rule.

CASB Admin Notification

This suggested template can be used to notify the team provisioning the solution about new alerts.

Recipients Set the recipients based on your needs
Subject

{{event.entity.suite}} Alert from Proofpoint team -

{{event.incident.name}}

Body

Dear Admin,

An alert for the following activity was generated: {{event.incident.name}}

{{#if event.resources}}

File: {{event.resources.[0].name}}

{{/if}}

Alert Severity: {{stringLastElementByDelimiter event.incident.severity delimiter=':'}}

User: {{event.user.email}}

Cloud Service: {{event.entity.suite}}

Alert Time: {{event.event.createdAt}}

Event Time: {{event.event.occurredAt}}

User Agent: {{#if event.remote.client.agent.description}}{{event.remote.client.agent.description}}{{else}}N\A{{/if}}

Device: {{#if event.remote.client.device.kind}}

{{stringLastElementByDelimiter event.remote.client.device.kind delimiter=':'}}{{else}}N\A{{/if}}

 

{{#filter event.indicators "pfpt:cloud:threat" property="kind"}}

Risk Level: {{stringLastElementByDelimiter this.risk.level delimiter=':'}} 

Description: {{#if this.description}}{{this.description}}{{else}}{{this.name}}{{/if}}{{/filter}}

 

To find more regarding this alert, please click <a href={{#if config.vanityExploreZoneName}}https://{{event.feed.details.tenant.alias}}.{{config.vanityExploreZoneName}}{{else}}{{config.externalURL}}{{/if}}{{#if event.incident}}/v2/apps/search/incidents/new/search?fqid={{else}}/v2/apps/search/activities/new/search?fqid={{/if}}{{event.fqid}}&amp;region={{event.feed.region}}>here</a>

 

Thank you,

The Proofpoint team

CASB End-User Notification

This suggested template can be used to notify end-users about alerts that were triggered related to their activities.

Recipients {{event.user.email}}
Subject

{{event.entity.suite}} Alert from Proofpoint team -

{{event.incident.name}}

Body

Dear {{event.user.displayName}},

An alert for your following activity was generated: {{event.incident.name}}

{{#if event.resources}}

File: {{event.resources.[0].name}}

{{/if}}

Alert Severity: {{stringLastElementByDelimiter event.incident.severity delimiter=':'}}

User: {{event.user.email}}

Cloud Service: {{event.entity.suite}}

Alert Time: {{event.event.createdAt}}

Event Time: {{event.event.occurredAt}}

User Agent: {{#if event.remote.client.agent.description}}{{event.remote.client.agent.description}}{{else}}N\A{{/if}}

Device: {{#if event.remote.client.device.kind}}{{stringLastElementByDelimiter event.remote.client.device.kind delimiter=':'}}{{else}}N\A{{/if}}

 

{{#filter event.indicators "pfpt:cloud:threat" property="kind"}}

Risk Level: {{stringLastElementByDelimiter this.risk.level delimiter=':'}} 

Description: {{#if this.description}}{{this.description}}{{else}}{{this.name}}{{/if}}{{/filter}}

 

Thank you,

The Proofpoint team

CASB Common Fields to be Used in Notifications

Field Name Notification Parameter
Alert Name {{event.incident.name}}
Alert Severity {{stringLastElementByDelimiter event.incident.severity delimiter=':'}}
Alert Time {{event.event.createdAt}}
Event Time {{event.event.occurredAt}}
Event Name {{stringLastElementByDelimiter event.activity.primaryCategory delimiter=':'}}
User Email {{event.user.email}}
User Name {{event.user.displayName}}
User’s Manager (for M365 only) {{stringLastElementByDelimiter event.user.directory.manager.aliases.value delimiter=':'}}
File Name {{event.resources.[0].name}}
File Host {{event.resources.[0].container.name}}
File Path {{event.resources.[0].path}}
File Owner {{event.resources.[0].owner.user.name}}
File’s Share Level {{stringLastElementByDelimiter event.resources.[0].permissions.share.level.designation delimiter=':'}}
Third Party App Name {{event.activity.api.resources.[0].name}}
Suspicious Login Severity {{#filter event.indicators "pfpt:cloud:threat" property="kind"}}{{stringLastElementByDelimiter this.risk.level delimiter=':'}} {{/filter}}
Suspicious Login Description {{#filter event.indicators "pfpt:cloud:threat" property="kind"}}{{this.description}} {{/filter}}