Data Security Posture Management (DSPM) is a methodology that allows organisations to locate and classify sensitive data across their data stores, assess the risks associated with this data’s exposure based on its sensitivity, and implement access controls to this data.

Key Components of DSPM Tools

• Data Discovery and Classification Automatically identifying and categorising data across an organisation’s data stores, particularly those in the cloud, based on sensitivity and regulatory requirements.

• Risk Assessment Evaluating the security risks associated with both structured and unstructured data, considering factors such as exposure, access patterns and potential impact if breached.

• Access and Permissions Management Ensuring that access to data is strictly controlled and that permissions are granted based on the principle of least privilege.

• Data Protection Recommending security measures such as encryption, data masking and access controls to protect sensitive data.

• Monitoring and Alerting Continuously monitoring data access and usage to detect suspicious activities or policy violations, with real-time alerts to facilitate rapid response.

What is GQL

• GQL: Query language

• Based on: Apache Lucene

• Supports: Boolean, term, and range queries

• Use: For custom queries without hard coding

Querying:

• Choose terms from specific dataset: Files, Trustees, Activity, Management

• Apply operations like AND, OR, =, !=, >, <, >=, <= to filter data

• Form queries, e.g., flow=classification AND risk>=1.

Examples:

• Simple: dataAttributeName=HR

• Complex: complianceTag=PII AND dataAttributeName=HR AND (dataAttributeName= Record OR dataAttributeName=Legal) AND (detectorHits="Health Insurance" OR detectorHits="Compliance report")

Aggregation (Analytics):

• Use in widgets for counters, charts, maps

• Aggregate terms for complex visualisations

Mark to create

Mark to create

K3s uses Flannel to allow pod to pod communication between different hosts, is a lightweight provider of layer 3 network fabric that implements the Kubernetes Container Network Interface (CNI). It is what is commonly referred to as a CNI Plugin.

Flannel supports multiple backends for encapsulating packets. By default K3s uses Virtual Extensible LAN (VXLAN), which runs a Layer 2 network on top of a Layer 3 infrastructure. VXLAN uses in-kernel VXLAN to encapsulate the packets using UDP on port 8472.

During one of our HA setups () we noticed after running tcpdump -leni any -w output.pcap the UDP packets were not arriving at the destination host and we had to change the Flannel backend from VXLAN to host-gw which uses IP routes to pod subnets via node IPs.

To use host-gw backend you need to execute the following steps in all the nodes:

Two-factor authentication (2FA) enhances security by requiring users to provide two forms of identification before they are granted access. This method adds a layer of protection to the standard username and password method, making it significantly more challenging for potential intruders to gain unauthorised access.

Implementing 2FA in Keycloak helps organizations bolster their defences against data breaches and unauthorized access, which is crucial for protecting sensitive data in today’s digital landscape.

How to configure it?

1. Going to the 'Authentication' tab, clicking on the browser

A VM or server with the following specifications:

• 16 x CPU cores (x86_64 processor with speed of 2.2 GHz or more). The CPU must support the instructions SSE4.1 SSE4.2 AVX AVX2 FMA

• 64GB RAM

• 700GB Free SSD disk. K3s will be installed in /var/lib/rancher so space should be allocated there. We also need 10-20 GB free space at / and /var.

To access and use the Portal, please follow the below steps:

1. Access the Portal by visiting

2. If an account has not yet been created (this is usually sent via email upon first contact with ), select the 'Sign Up' option located in the top right corner of the screen.

3. When the email is received, use the URL provided in the email to set a new password. After setting your password, the 'Login

To view the Critical and Sensitive Classification rule configuration from the Dashboard Click on Administration > Detectors > Attributes Detectors

Here the Critical and Sensitive attributes configuration can be viewed.

The Critical & Sensitive rules for Risk calculation can be re-configured by clicking the pencil icon beside the rule.

The Risk rules are based on a GQL query which can changed by clicking on the pencil icon on the right or by importing a JSON file using the “Import from file” function.

Once the edits are saved, the Sensitive and Critical Flags will update automatically. For the Risks to be recalculated, a rescan is needed.

Getvisibility products use Kubernetes under the hood, and we have very specific hardware requirements. It's crucial to meet the minimum resource requirements defined for containers, as failing to do so can lead to various problems:

1. Resource Starvation: If a container requests more CPU or memory resources than are actually available on the cluster, it can lead to resource starvation. This means other containers may not get the resources they need to run correctly, causing performance degradation or even crashes.

2. Throttling: Kubernetes imposes resource limits for containers, and if a container's requested resources exceed its limits, Kubernetes may throttle or terminate the container to prevent it from consuming excessive resources, resulting in performance degradation.

3. Out of Memory or CrashLoopBackOff Errors: Oversubscribing memory resources can lead to containers running out of memory, causing them to terminate abruptly or enter a constant restart loop, commonly referred to as a "CrashLoopBackOff" error.

4. Performance Degradation: When requested CPU resources are larger than allocated, it can lead to performance issues as containers compete for CPU time, potentially slowing down critical processes and making the application unresponsive.

5. Difficult Troubleshooting: Misallocation of resources, whether it's too little or too much, can be challenging to identify and correct. This can lead to extended troubleshooting efforts and downtime as administrators attempt to resolve resource-related issues.

To ensure a stable and efficient Kubernetes deployment of our product, it's essential to accurately configure resource requests and limits for containers based on their actual requirements. This prevents resource-related problems and ensures smooth operation within the Kubernetes cluster.

The deployment guide will help you install, configure, and manage your deployment environment. It covers everything from initial setup to advanced configurations and troubleshooting.

It includes:

• Prerequisites for a successful installation.

• Step-by-step instructions for installing and upgrading K3S.

• Setting up Rancher and Fleet agents with an HTTP proxy.

• Guide to installing Synergy/Focus/Enterprise using Helm without Rancher.

• Guide for configuring Keycloak.

• Troubleshooting guide.

TODO

Prerequisites

Please check K3S installationfor installation requirements.

Installation

1. Go to Rancher dashboard and click on the customer cluster that by now should be Active:

1. Go to Apps > Charts and install the GetVisibility Essentials Helm chart:

2.1. Click on Enable ElasticSearch:

2.2. Configure the UTC hour (0-23) that backups should be performed at:

1. Go to Apps > Charts and install the GetVisibility Monitoring Helm chart and Install into Project: Default.

1. Go to the global menu Continuous Delivery > Clusters and click on Edit config for the cluster:

a. For Synergy: add 2 labels product=synergy environment=prod and press Save.

b. For Focus: add 2 labels product=focus environment=prod and press Save.

c. For Enterprise: add 2 labels product=enterprise environment=prod and press Save.

d. For DSPM with the Agent: add 2 labels product=ultimate environment=prod and press Save.

e. For DSPM without the Agent: add 2 labels product=dspm environment=prod and press Save.

This is applicable when there is a cluster showing as “unavailable“ after the user configured a proxy on the server.

1. Run env on the user’s server to determine what is the proxy IP. Ensure that the following line is checked:

2. Open the file /etc/systemd/system/k3s.service.env and append the following lines:

1. Restart k3s:

1. Go to the Rancher dashboard Cluster Management > Clusters and click on Edit Config for the cluster:

a. Go to Advanced Options:

b. Configure the following Agent Environment Variables and press Save:

1. Run the command:

6. Type letter “i“ to insert text and on the env section, type the following lines:

Example:

Save by pressing Esc and then typing "wq"

1. Do the same on the fleet-agent by running the command:

1. Repeat Step 6.

2. After applying all the changes, wait for the cluster to show as Online on Rancher.

Configure Dashboard

In order for the connectors to support proxy settings, you will need to enable it in the configuration page:

To check the AI Mesh version from the Dashboard click on Administration > AI Mesh

In the top right of this screen the AI Mesh Version can be seen.

If more information on the AI Mesh is required or if tailoring is needed please contact Support.

When a targeted rescan is needed it is possible to scan individual files or a specific selection.

Reasons for a rescan can include:

Ensuring that recent changes to files are reflected in the UI.

If new patterns have been added to Pattern Matching.

If new rules have been added in Controls Orchestration.

Files can be sent for rescan individually by clicking on the hamburger menu for that file and click on “send to classification pipeline.

There is also an option to reclassify multiple files at once by selecting them using the tickboxes on the left of the screen.

Once the required files are selected the option to rescan appears on the bottom right of the screen.

The required permissions for scanning are documented by Data Source.

For more information please review the list here.

To Check the configured permissions for a Data Source Navigate to Administration > Data Sources and click on the hamburger menu.

In the dropdown click permissions.:

The example below shows the permissions for SharePoint Online.

When a Data Source is added to Getvisibility for scanning, the scan begins automatically.

If a rescan is needed this can be configured by clicking on Administration > Data Source > (the Data Source that needs Rescan e.g. One Drive) > Hamburger menu > Rescan Scheduler.

The default configuration is Does Not Repeat.

By clicking the drop-down menu other options can be choosen:

Daily

In this option both the time zone and time of day can be chosen

Weekly

With this option as well as the above configuration a specific or multiple days of the week

Monthly

This gives the option to pick a specific day or days each month to run the rescan.

If you have a cluster which hasn’t been registered yet (registration command has not been run yet), then refer to .

Scan Analytics shows in-depth information gathered during the scan.

There are two ways to access Scan Analytics, either via the main Analytics Dashboard or via the Data Sources page.

Analytics Dashboards

To access the Analytics Dashboards click on the link on the Getvisibilty homepage.

Configuring SMB connector in Dashboard

• Navigate to Administration -> Data Sources -> SMB -> New scan

• Keycloak configuration (each part ends with a whats next) + Log in to an existing account

• Set up an integration (configure a data source)

• Configure taxonomy → link to a full taxonomy setup

1. Filter by Streaming: Under Enterprise Search, use the filter scanTrigger=streaming.

2. View File Details: DDR displays:

   1. File Path:

The platform supports a wide range of Single Sign-On (SSO) protocols and providers, enabling seamless authentication across various services and applications. Here are the primary SSO protocols and some of the identity providers that Keycloak can integrate with:

SSO Protocols

1. OpenID Connect (OIDC): A modern, widely adopted protocol based on OAuth 2.0 for client authentication and authorization. It's used by many identity providers for secure and flexible user authentication.

Below is a list of Data Sources that Getvisibility DDR (Streaming) currently supports:

• AWS IAM

• AWS S3

• Azure AD

Trustee Scan

This scan provides the list of Users and Groups on a Data Source

File Scan

This scan provides information about files and folders on a Data Source including structure and metadata.

Once both scans are completed the data is processed and the two sets are combined to show who has access to what files.

No, file content is never saved. The classification server maintains a registry of file names and their properties but not the content. There is also an anonymization mechanism built into the Classification software that reduces file content to a mathematical number that is used throughout the platform.

More specifically when a Data Source is added to the platform the following occours:

• Data source scanned and general meta data is read.

• This provides file path and permissions on the files.

• The files are then sent to the OCR service to read the content.

• The read content is then passed through the AI Mesh.

• Through the process, customer data is not stored on disk and is only ever held in memory.

• There is no long-term storage of data.

Azure app configuration

Create new Azure app

Create a new App registration from selecting support for Multiple organizations when asked.

Find App registration in search.

Click New registration.

Fill in details as shown below.

Give the application a name and write down Application (client) ID as it will be needed later.

Configure a new secret

Next, go to your App Registrations’ Certificates & secrets to create a New client secret. Copy the Value of the secret to somewhere at had as it is needed later in the configuration.

Adding Keycloak IdP

In Keycloak, create a new IdP by selecting Microsoft from the drop down

Populate Client ID (this is Application (client) ID in Azure) and Client Secret (this is Value from Azure) using values obtained in previous steps.

Finally copy Redirect URI from Keycloak and add Redirect ID UI link in Azure App.

Test the functionality

Open up a new Incognito mode in a browser and use

Create OAuth2 Credentials

• Create a Project in Google Cloud Console:

  • Go to the

  • Create a new project or select an existing project
• Enable the Gmail:

  • In the Google Cloud Console, navigate to the "APIs & Services" > "Library"

  • Search for "Gmail API" and click on it
• Create OAuth 2.0 Credentials:

  • In the Google Cloud Console, navigate to the "APIs & Services" > "Credentials" tab

  • Click "Create credentials" and select "Service account"

Delegate domain-wide authority to your service account

• From your domain's , go to Main menu menu > Security > Access and data control > API controls

• In the Domain wide delegation pane, select Manage Domain Wide Delegation

• Click Add new

• In the Client ID field, enter the client ID obtained from the service account creation steps above

• In the OAuth Scopes field, enter a comma-delimited list of the scopes required for the application

• Use the below scopes:

  For scanning

  • https://www.googleapis.com/auth/admin.directory.user.readonly

  • https://www.googleapis.com/auth/gmail.readonly

  For tagging

The below screenshot shows the fields that appear in the Scan Configuration screen.

Please note that not all of these fields are available for all Data Sources.

Name

Set a unique name so that the Data Source is easy to identify.

Credentials

This a dropdown to select the credentials that have already been configured for the Data Source.

Geographic Location

This is to indicate the physical location of the server the data sits on.

Path

This only needs to be defined for a specific location needs to be scanned.

If left blank the entire Data Source will be scanned.

Data Owner

This is the person that is to be the person responsible for the data.

This setting is optional.

If the Data streaming check box is not visible it may be because the license for DDR is not present.

To learn more about getting a license for DDR please reach out to the Getvisibility Enablement Team.

Configuring LDAP connector in Dashboard

• Navigate to Administration -> Data Sources -> LDAP -> New scan

• Enter the details of the LDAP server to scan

  • Name: Give a name to the scan to identify it later

  • Username: The user must be an admin level and have access to all the LDAP utilities to be scanned. The username should be entered in the format [email protected]

  • Password: Password for the admin user
• Save the configuration

• Once the configuration is saved, click on the icon on the right and select Start trustee scan to begin scanning

• The scan results can be viewed under Dashboard -> Access Governance

Generating an API token

• Log in to

• Click Create API token

• From the dialog that appears, enter a memorable and concise Label for the token and click Create

• Click Copy to clipboard, and save it somewhere secure. It isn't possible to view the token after closing the creation dialog

Configuring Confluence Cloud connector in Dashboard

• Navigate to Administration -> Data Sources -> Confluence Cloud -> New scan

• Enter the details

  • Name: Give a name to the scan to identify it later

  • Username: The email address for the Atlassian account you used to create the token

• Save the configuration

• Once the configuration is saved, click on the icon on the right and select Start trustee scan to begin the trustee scanning

• The scan results can be viewed under Dashboard -> Access Governance

• Click on the icon on the right and select Start file scan to begin the files scanning

• The results can be viewed under Dashboard -> Enterprise Search

Rancher manages clusters through its control plane. Managed clusters send data to Rancher's central management servers. This includes "always-on" data, exchanged with Rancher whenever the cluster has Internet access, and "on-demand" data, which should be explicitly requested by GetVisibility Support via the Rancher UI.

Always-On Data sent to Rancher includes:

1. Cluster Metadata:

   • Information about the cluster

   • Nodes list and metadata (IP address, hostname, cluster role, etc.)

   • K3s version

2. Health and Monitoring Data:

   • CPU and RAM usage on each cluster node

   • Current Metrics (via Prometheus)

   • Fleet agent heartbeat

On-Demand Data:

1. Cluster Metadata:

   • Resource allocation (which Kubernetes resource runs on which node)

   • Current cluster-level Alerts

   • Current cluster-level Events

kubectl Commands Output:

Rancher allows running kubectl exec into running containers, but this feature is blocked by our WAF. Support needs SSH access or screen-sharing with the customer to execute these commands.

None of those categories are critical for operation, and access to Rancher can be disabled after deployment.

Cloud Data classification with Google Drive (GDrive) Auto-labelling

At Getvisibility, we understand the modern challenges of data management. With our leadership in Data Security Posture Management (DSPM), we're transforming the way organisations comprehend, classify, and protect their data.

Getvisibility is a DSPM solution that can conveniently connect, discover, classify, and enable the protection of unstructured data in an organisation's data repositories. Our latest update includes connectors for GDrive, a real-time file storage and synchronisation service that is a product within Google Workspace, which has over 9 million paying organisations. Our GDrive connectors provide an easy setup for file scanning to begin and for insights on an organisations data to be delivered at speed.

Utilising Getvisibility's cutting-edge Machine Learning (ML) classification to label files in GDrive represents a significant step in managing your sensitive data, regardless of its origin. Step into the future of data protection with Getvisibility by applying high precision tailored artificial intelligence (AI) coupled with Google Drive's native file labelling to significantly enhance the security of your Google Drive data, automatically and at scale.

With our Google Drive Auto-Labelling feature, you no longer need to manually tag your files. Let our high precision, bespoke artificial intelligence (AI) mechanisms, integrated with Google Drive's native file labelling, classify and protect every document in your GDrive, automatically and at scale.

Addressing the modern Data Security challenges

Remote working, regulatory compliance, constant pressure of cyber attacks bring forward challenges encompassing interoperability, scalability, and governance. These complications can escalate to severe security breaches, including threats like intellectual property theft, both from internal and external sources. It's essential to counter these data security concerns with a robust DSPM solution. Getvisibility's Tailored & Narrow AI, charged by Large Language Model (LLM), aligns perfectly with distinct business needs for precise data analysis. Our state-of-the-art AI system can:

• Minimise data handling costs by pinpointing only essential data to keep.

• Provide reports on data at risk.

• Seamlessly integrate with DLP platforms.

• Automatically tag files.

Benefits tailored for you:

• Enhanced Data Security: Every file, irrespective of size, is labelled, solidifying its traceability and protection.

• Time-saving Mechanism: Move past the era of manual classification. Entrust our machine learning and witness your files being labelled in no time.

Dive deeper with GetVisibilty's GDrive auto-labelling

Why settle for the ordinary? Experience unmatched efficiency and security with our innovative solution. For a comprehensive understanding of how Getvisibility can redefine your organisation's data security landscape, reach out to us or explore our website.

For More Information:

Getvisibility's Data Detection and Response (DDR) solution is designed to protect sensitive data by providing near real-time detection and response capabilities. It ensures that data across user environments are constantly monitored and any potential threats are flagged immediately. DDR focuses on data-centric security, ensuring organisations have visibility and control over their critical information assets.

Key Features of DDR:

1. Real-Time Monitoring: DDR continuously identifies data activities, including access, modification, sharing, deletion, and other activities to identify suspicious and malicious events.

2. Automated Response: DDR sends instant alerts for quick remediation.

3. Risk Mitigation: It ensures regulatory compliance with Privacy Compliance standards like GDPR, HIPAA, PCI-DSS, CCPA and other standards.

4. AI-Powered Insights: DDR leverages proprietary Getvisibility’s AI-mesh models to analyse data context for the best accuracy.

5. Data Intelligence: It provides dashboards with visibility into sensitive data and risks to your data.

How DDR Works:

1. Data Analysis: DDR identifies all data across unstructured data environments and then classifies the data based on its content and context.

2. Risks Analysis: It evaluates user access, permissions, sharing and data location to identify risks related to your data.

3. Policy Enforcement: DDR applies predefined and custom security policies to protect data based on its classification and sensitivity.

4. Incident Response:

Create Scan Configuration

To configure DDR rules, follow these steps:

1. Access the Getvisibility DDR dashboard using your credentials.

2. Under the DDR tab, select Create Scan Configuration to connect to the data sources to be monitored.

1. Define Scopes: Specify the data sources that will be connect to.

2. Verify Configuration: Ensure that at least one data source is successfully connected. A green checkmark will confirm the completion.

Check for Incoming Events

Once the scan configuration is complete:

1. Go to Administration > Live Events Streaming to view real-time events.

1. Monitor Event Activity: Filter events by source, user name, action type (create, update, delete), and event type.

Overview Page

The Overview Page provides a comprehensive view of DDR's performance:

1. Event Statistics: Displays the number of events by source, such as Google Drive, SharePoint, OneDrive, and Box.

2. Data Source Activity: Visualizes active data sources and the volume of events generated by each.

3. Event Timeline: Shows when events occurred, helping identify peak activity periods and anomalies.

Open Risks

The Open Risks section highlights detected threats, categorised by risk type:

• Public Exposure: Identifies sensitive files accessible to external users via public links.

• External Sharing: Detects files shared outside the organisation, potentially exposing sensitive information.

• Internal Over-Sharing: Flags data with excessive permissions within the organisation.

For each risk, DDR provides detailed insights, including the file path, user activity, and recommended remediation steps.

Using GV-Essentials chart

You can configure a custom TLS certificates during gv-essentials chart installation.

Go to TLS Certificate tab, click on Use Custom TLS Certificate and paste in the content of the certificate and private key in PEM format:

Use Self-signed Certificate

Sources

To review Scans and their status go to Data Sources in the Administration drop-down.

The scanning process discovers and analyses files across all configured data sources. It operates in three steps:

1) Discovery

Listed below are the languages supported by the ML (Machine Learning) classifiers, grouped by language pack.

K3s Installation - Client

Please refer to for the installation details.

Registering an Azure App

• Login to

A webhook is a way for one application to automatically send information to another application when something specific happens. For E.g. getting an instant message when a new email is received. It helps different apps talk to each other in real-time.

In DSPM+, the webhook service makes it possible to subscribe to documents after cataloguing/classification stages. When a document passes Cataloguing or Classification, based on GQL provided in webhook and callback URL is sent to the target system (client system). Similarly in EDC webhook can be used to send information to client system based on activity of the users.

Flow:

The pattern matching functionality allows users to identify particular pieces of information in a document. This is implemented by using Regular Expressions (RegEx) that will try match content.

Pattern Matching page

Select Administration and then Pattern Matching:

A selection of pre-configured patterns available:

If these patterns are detected during a scan they will be presented using the “Keyword Hits” to the user. On the Pattern Matching page, users have access to various Filters and Options:

Access global data security excellence with multi-language machine learning (ML) from GetVisibility

Getvisibility tackles unclassified data protection across multiple languages. We do this using a cutting-edge in-house Data Science team who are forging a global AI-driven solution. Here at Getvisibility we have intro- duced eleven new ML languages, including Arabic, Chinese, Spanish, and more, providing comprehensive multilingual data insights to our customers. Elevate your Data Security Posture Management (DSPM) with tailored AI that breaks language barriers for informed decisions when fortifying an organisation's data security defences.

firewalld/fapolicyd

It is recommended to disable and :

nm-cloud-setup

If enabled, it is required to disable

API key

Owners can generate an API key in the . Note that the correct Organization must be selected when creating a key, corresponding to the administered workspace. Do not select the owner's personal organization.

• Create a new API key:

To access the Taxonomy screen click on Policy Centre > Compliance Hub.

Once in the screen the default Tags are visible.

To add a label click on the + on the top left of the list of Tags.

In the pop up enter a name for the new Label and optionally a Tag alias.

About

Data Controls enable organizations to apply security and compliance conditions on the data assets in their systems, and apply actions on those rules when they are identified.

They are important for security and regulatory compliance as they help orchestrate the data handling within an organisation while ensuring stakeholders and data owners are involved.

They are set up during the configuration of the system and refined as the DSPM journey proceeds. They are used by data owners, CISOs, and other stakeholders throughout an organisation.

The data control rules are set using GQL, this can granularly define the files, users, or other assets that exist within the organisation and specify under which conditions the rule should activate.

A graphical display of any recent condition-activations can be viewed as well. Automated actions can be applied to the rule where users can choose to alert using messaging apps or webhooks.

The rules are configured in the DSPM platform under Data Controls. Simply select Create New Rule and follow the below instructions. The rules will be triggered during a scan of the particular dataset the rule applies to.

How to set a rule

In this example we will create a rule to find HR related data that is at high risk. We will assign ownership and set up a slack message to alert a specific channel.

1. On the Data Controls page of DSPM, select Create new rule

SCREENSHOT is outdated (DSPM / policy center; data rule / control orchestration)

1. Enter the following data to create the rule

• Name: To identify the rule amongst many that can be created

• Description: Useful for others to understand the intention of the rule

• Ownership: The person who is responsible for the rule and its consequences

• Based on group: The data asset that this rule is associated with. These are granularly defined in the Data Asset Registry.

• Select Accept

1. This screen allows you to further refine the rule and set the actions

SCREENSHOT is outdated (DSPM / policy center; data rule / control orchestration)

1. At the top of the screen: the name, description, and owner are visible, as well as the creation date. The option to assign rule severity is also available. As this rule, if it were breached, has the potential to incur severe consequences such as legal and financial penalties, we will set it as High.

2. In the select dataset dropdown, we need to define the entity types we are setting our conditions for. (In the backend this relates to separate databases). The choice will be for files, trustees, and activities.

• Files: unstructured data classified during discovery

• Trustees: the users and groups discovered during IAM scans

• Activities: the usage statistics of the endpoint agents (FDC)

We will select files in this example.

The condition section will be pre-loaded with a GQL if you have selected a Data Asset Group. Here it is simply path=HR and we can see that there are some recent files that match this criteria.

1. We will refine the search further by adding the condition that the HR files found will be high risk. AND risk=2

The platform has three levels of risk: low, medium, and high. Their respective values in GQL are: 0, 1, and 2

As can be seen, no files have yet to fall under this rule.

We can create an action so that we can catch high risk HR files going forward.

1. Scroll to below the condition and select Create Action. In the Action type dropdown you can choose a simple Webhook or a Slack Webhook. Here we will add a Slack Webhook that will notify a Slack channel when the data control is activated.

Multiple actions can be created for the same data control.

1. Select UPDATE to save the control, and that’s it! Once scanning commences we will get notified in Slack, as well as on the Incidents page.

SCREENSHOT is outdated (DSPM / policy center; data rule / control orchestration)

Prerequisites

Please refer to K3S installationhere for installation requirements.

Installation

All the commands in this runbook were tested against a VM with Canonical, Ubuntu, 20.04 LTS, amd64 as root.

1. Install K3s and wait for the pods to become ready:

1. Install Helm 3:

1. Configure GetVisibility private Docker image registry (replace $USERNAME and $PASSWORD with the Docker credentials provided):

1. Configure GetVisibility private Helm repository (replace $USERNAME and $PASSWORD with the Helm credentials provided):

1. Install chart GetVisibility Essentials and wait for the pods to become ready. For Synergy (32 GB RAM machines), please replace keycloak.url= IPADDRESS/DNS/FQDN with IP Adress or FQDN or DNS name for Keycloak in formats like below or or

For Focus and Enterprice (48+ GB RAM machines), please replace keycloak.url= IPADDRESS/DNS/FQDN with IP Adress or FQDN or DNS name for Keycloak in formats like below or or

1. Depending on the theme you want to use, run one of the commands below to install the chart GV Platform (don’t forget to replace $PRODUCT with either synergy or focus or enterprise):

a. GetVisibility theme:

b. Forcepoint theme:

Upgrade

GV Essentials

In order to upgrade the essential services (e.g. Postgres, Kafka, MongoDB, Consul) run helm repo update and then the same command you used in step 5.

Synergy/Focus/Enterprise

In order to upgrade Synergy/Focus/Enterprise run helm repo update and then the same command you used in step 6.

Monitoring

You can optionally also install monitoring tools to collect metrics and logs of all services that are running inside the cluster:

1. Install the CRDs:

1. Install the monitoring tools:

To access the Grafana dashboard run the command:

To access Prometheus dashboard run the command:

1. To authorize users for the GetVisiblity dashboard (not Keycloak itself), ensure that the gv realm selected in the top left, not master (unless the aim is to authorize LDAP users to use Keycloak):

1. Click on the User Federation menu item on the left pane. This should load a list of configured user federations (none at first).

1. Click on Add Ldap providers to load the LDAP (Lightweight Directory Access Protocol) configuration

1. Update the Connection URL field to reflect the LDAP server address where the Active Directory is hosted

1. Click on the button Test connection to test the connection from the Keycloak instance to the LDAP server address. This should succeed quickly. If it hangs, the LDAP server (i.e. a domain controller) may be blocking connections from the Keycloak server address (i.e. the IP of the server running the GetVisibility product). The Public IP address of the LDAP server may need to be used.

1. Update the Bind DN field to reflect the user used to access the LDAP server. In this case, the user with username “admin” from the domain “”.

1. Update the Bind credentials field (see the above image) to contain the password used to access the LDAP server

2. Click “Test authentication” to confirm that the provided credentials work as expected:

1. Update the Users DN field to contain the Full DN of the LDAP tree where your users are.

If this is not desired, make restrictions to which users are imported. Often, just restricting by OU is not granular enough.

In this scenario, use in the User LDAP filter field, like so: (memberOf=cn=My Group,dc=domain,dc=com)

Combining (“AND”) with other criteria: (&(theAttribute=theValue)(memberOf=cn=My Group,dc=domain,dc=com))

Optional Steps

1. Within Synchronization settings, set up automatic synchronization of users from the LDAP Active Directory to Keycloak. Here the auto-synchronisation settings can be configured.

1. Click the Save button at the bottom of the screen.

Synchronizing the Users to Keycloak DB

To get the users into the Keycloak DB, the users need to to be synchronised for the first time (before the automatic synchronization happens, if applicable).

Click the button Synchronize all users to immediately fetch all of the LDAP Active Directory users and load them into the Keycloak instance DB

Troubleshooting Keycloak LDAP integration

Usually, any issues that occur during the LDAP Active Directory configuration process above will be related to Network accessibility concerns or authentication credentials being incorrect.

However, if additional support is needed or the problem is not easily resolved by troubleshooting Network communications and authentication details, please reach out to .

Template Language (GTL) allows using variables, functions and conditions in any report text input fields and compiles those expressions into resulting values.

Example

Example with actual data

Syntax

Two possible syntaxes parsed by GTL:

• Expressions

• Conditions

Expressions

Any text placed between {{ and }} is considered an Expression. Expression is a mathematical or logical operation that returns a value. For example, this {{ 10 }} is an expression that returns the number 10. It is possible to use operators, {{ 10 + 5 }} will return 15. Logical operators are also supported, {{ 10 > 5 }} will return true. Here is a list of supported operators:

+ - * / % = != > < >= <=

Expression can also contain variables, that are defined in the current context. For example, {{ file.name }} will return the name of the file, if the file object is defined.

Expression Functions

But the most powerful feature of the expressions is the ability to call functions. These are predefined aggregation functions, that fetch data from the database and return the result. For example, {{ count('files') }} will return the number of files in the database.

Here is a list of supported functions:

• count

• sum

• avg

• max

Those functions support the following parameters:

• Dataset name - the name of the dataset to fetch data from. Possible values are: files, trustees, connectors, agents, activities.

• GQL - the GQL query to filter the data. For example, fileType=doc OR fileType=txt will return only files with the doc or txt

Conditions

Conditions are useful when you want to display different text based on some condition. Example:

else clause is optional and can be omitted:

The if statement is followed by a condition in parentheses. The condition must be any expression that returns a boolean value.

Webhooks

A webhook is a method used in web development to enhance or modify the behavior of a web page or application through custom callbacks. These callbacks are automated messages sent by applications when specific events occur. Triggered by events in a source system, webhooks generate HTTP requests with payload data, which are sent to a destination system. Webhooks enable real-time communication between different applications, allowing them to exchange data seamlessly and synchronize processes. Developers, even if not affiliated with the originating application, can manage and modify these callbacks. This event-driven communication approach finds applications in various scenarios, enhancing automation and integration between different software systems.

Using Webhooks in SIEM software

Webhooks are used by Security Information and Event Management (SIEM) software to enhance security monitoring and incident response. SIEM tools integrate with webhooks to receive real-time event notifications from various sources, such as authentication systems, cloud services, or other security tools. These notifications trigger automated actions in the SIEM, allowing it to detect and respond to potential security threats promptly. Webhooks provide a seamless way to feed event data into SIEM systems, enhancing threat detection, analysis, and reporting capabilities. This integration enables organizations to achieve more effective and efficient security operations, as SIEM software can aggregate and correlate data from diverse sources to provide a comprehensive view of the security landscape. The result is improved incident response and better protection against cyber threats.

Example: logging Focus classification events with Pipedream into Google Sheets

Pipedream is an integration platform designed for developers to connect APIs rapidly using a low-code approach. It allows users to create workflows that integrate different applications, data sources, and APIs, without the need for extensive coding. Pipedream facilitates event-driven automations by providing a hosted platform where users can develop and execute workflows that streamline processes and automate tasks. With Pipedream, developers can build efficient connections between various services and systems, reducing the need for manual intervention and accelerating development cycles. The platform offers open source connectors and supports multiple programming languages like Node.js, Python, Go, and Bash. Pipedream simplifies the integration of disparate apps and enables developers to create effective workflows with ease, contributing to enhanced efficiency and productivity in software development.

Workflow

In , a workflow is a sequence of steps that automate processes and connect APIs. Workflows make it easy to create and manage integrations, allowing developers to connect different applications, services, and data sources. Workflows consist of steps that are executed in order, and they can include actions, code, and triggers. Triggers define when a workflow is initiated, such as through HTTP requests or scheduled intervals. Each step in a workflow can perform actions like connecting to APIs, manipulating data, and more. Pipedream enables users to create workflows with code-level control when needed, and even offers a no-code approach for automation. Workflows in Pipedream simplify the automation of complex tasks, integration of APIs, and the creation of event-driven processes.

Create first Trigger in Pipedream

Trigger is a fundamental concept that defines the initiation of a workflow. Triggers specify the type of event or condition that starts the execution of a workflow. These events can include HTTP requests, data from external apps or services, scheduled intervals, and more. When a trigger event occurs, the associated workflow is automatically initiated, and the defined steps within the workflow are executed sequentially. For instance, you can set up a trigger to activate a workflow when an HTTP request is received at a specific URL, allowing you to automate actions based on external events. Pipedream's triggers enable developers to create dynamic and event-driven workflows that respond to various inputs and conditions, enhancing automation and integration capabilities.

Create your first trigger by using [New HTTP/Webhook Requests] option.

No need to configure anything here.

We are going to use later newly created URL when configuring a webhook in Focus.

Create Webhook in Focus

Please refer to for guidance how to setup webhooks.

To capture classification events we are using “flow=CLASSIFICATION” query.

Start a scan

Please refer to to guidance on how to start a scan.

An event reached out P

We can continue with our workflow after first event reach out Pipedream workflow.

After configuring Pipedream to add rows to our test spreadsheet in Google Sheets our workflow is completed.

We can now Deploy is and head over to the Sheet to check it in action.

Result

The workflow is now completed and as a result out Sheet is being populated with classification events.

Create a policy

• Sign in to the AWS Management Console and open the IAM console with the appropriate admin level account

• In the navigation pane on the left, choose Policies and then choose Create policy

• In the Policy editor section, find the Select a service section, then choose IAM service, and select Next

• In Actions allowed, choose the below actions to add to the policy:

  • Read > GetUser

  • Read > GetPolicyVersion

  • Read > GetPolicy

• For Resources, choose All and select Create policy to save the new policy

Create a user

• Sign in to the AWS Management Console and open the with the appropriate admin level account

• In the navigation pane on the left, choose Users and then choose Create user

• On the Specify user details page, under User details, in User name, enter the name for the new user, example iam-connector-user and select Next

• On the Set permissions page, select Attach policies directly and choose the policy created in above steps

• Select Next

• Once the user is created, select it, and from the user page, choose Create access key

• Select Other then Next

• Enter a description if you wish and select Create access key

• The Access and Secret Access Keys have now been created. These can be downloaded as a CSV, and also copied from this section. NOTE: the secret access key cannot be viewed once you leave this page

Configuring AWS IAM connector in Dashboard

• Navigate to Administration -> Data Sources -> AWS IAM -> New scan

• Provide the access key and secret access key values generated in the above steps

• Save the configuration

• Once the configuration is saved, click on the icon on the right and select Start trustee scan to begin the scanning

• The scan results can be viewed under Dashboard -> Access Governance

Overview of Lineage

Data Lineage in Getvisibility provides a comprehensive view of a file's lifecycle, tracking its origin, movement, transformation, and usage. This enhances security, compliance, and forensic investigations by offering end-to-end visibility into data activities.

Traditional data monitoring provides static snapshots, which quickly become outdated, especially for large datasets. Real-time lineage addresses this by:

1. Reducing Dependency on Rescans: Once streaming is enabled, changes are captured instantly.

2. Improving Visibility: Organizations can see data movements in near real-time.

3. Enabling Faster Incident Response: Security teams can quickly assess and respond to threats.

Use Cases

Data Lineage was developed to enable forensic investigations, ensuring organisations can:

1. Investigate Incidents: Identify the root cause of security incidents, such as data breaches or unauthorised sharing.

2. Enhance Compliance: Maintain audit trails for regulatory requirements.

3. Support Risk Mitigation: Quickly respond to suspicious activities and apply appropriate remediation actions.

Pre-Requisites to See Lineage

1. Connection to Each Data Source: Ensure that each Data Source to be monitored has been configured in Getvisibility.

2. Enabling Streaming: Activate real-time event streaming for each connector.

Navigation to Lineage

1. From Enterprise Search: Select a file and click on "Lineage" in the dropdown.

1. From Open Risks: Identify a flagged file and expand the side menu.

Lineage UI Explanation

Filters:

• Event Type (Create, Modify, Delete, Share, Move, etc.)

• Data Source

• User Activity

Export:

• Export lineage details to CSV for auditing and reporting.

Color Scheme:

• Green: Normal activity

• Yellow: Medium-risk events (e.g., permission changes)

• Red: High-risk events (e.g., external sharing)

Description of the Lineage Screen

Lifecycle: Displays the complete lifecycle of a file from creation to current state.

Event Timeline: Chronological list of all file-related actions.

User & Device: Shows which users and devices interacted with the file.

File Path: Original and current locations of the file.

List of Events Supported by Each Data Source

Common Events:

• Create

• Modify

• Delete

Extended Events (via Audit Logs)

• Change Permissions

• Share

• Move

• Copy

Data Source Specifics:

• Google Drive: Audit log events available.

• Azure (SharePoint Online, OneDrive, Blob, Files): Audit log events supported.

• Box & Confluence: Extended events available in regular logs.

• AWS S3, SMB, Dropbox: Limited to Create, Modify, and Delete.

Use Case for Lineage

Lineage supports forensic investigations, such as:

1. External Sharing Investigation: When a file is shared externally, security analysts can trace its history to determine if the action was intentional or accidental.

2. Suspicious Activity Investigation: If a user accesses and downloads sensitive information after a password reset, lineage provides detailed insights.

3. Incident Response: Analysts can determine what actions to take, such as revoking access, quarantining files, or addressing user behaviour.

How to Access Lineage

1. Enterprise Search: Select the file, click the dropdown, and choose "Lineage."

2. File View: Expand the file details and navigate to the "Lineage" tab.

Hover and Export Options

1. Event Description: Hovering over event icons shows a brief description.

2. Export: Export the entire lineage history, including metadata, to CSV for audit trails and reporting.

Data Lineage empowers organisations with real-time visibility, advanced threat detection, and comprehensive forensic capabilities, ensuring sensitive data remains secure and traceable.

Configuring SharePoint On-Premise connector in Dashboard

• Navigate to Administration -> Data Sources -> SharePoint On-Premise -> New scan

• Provide the Domain URL, an admin username and its password

• Click on the Folder icon in Site and path to select a particular site to scan, or leave the path as empty to scan all sites

• Save the configuration

• Once the configuration is saved, click on the icon on the right and select Start file scan to begin the scanning

• The results can be viewed under Dashboard -> Enterprise Search

File tagging

Prerequisites

• An admin level user is required to scan and tag files in SharePoint On-Premise. The user must be a member of Site Owners Group where they have full control permissions to the SharePoint site.

• The default Getvisibility tags need to be created as a new column in their SharePoint. This process is described below:

  • In SharePoint, navigate to Documents

  • In the files view, select + Add column

Supported SharePoint On-Premise versions:

The connector supports SharePoint 2013, 2016, 2019.

1. Go to Administration > Quick Start.

2. Under the Data Controls section, enable predefined DDR rules, such as:

   1. Public Exposure of Personal Identifiable Information (PII).

   2. Detection of Protected Health Information (PHI).

   3. Monitoring of Payment Card Industry (PCI) data.

3. Import the desired Control Rules to start monitoring immediately.

Note that any sizing provided can be subject to change due to environmental variables. Below we outline some of the variables that can affect the sizing:

• Server resources. e.g. physical vs virtual, physical underlying CPU, RAM, and disc specs/speeds and whether they are shared or dedicated.

• Network (speed, latency and throughput)

• Geolocation

Registering an Azure App

• Login to

• If there are multiple tenants to choose from, use the Settings

Create a policy

• Sign in to the AWS Management Console and open the with the appropriate admin level account

• In the navigation pane on the left, choose

To connect Forcepoint DSPM to your iManage server, you will need to gather three key pieces of information:

1. Your Server's URL: The fully qualified domain name of your iManage server (e.g., imanage.mycompany.com).

2. An Application Client ID: A unique ID from your iManage Control Center that identifies the Getvisibility application.

This guide walks you through enabling real-time data streaming for a SMB connection and how to monitor live streaming events within the Getvisibility platform.

Steps to Enable Data Streaming for SMB

This guide walks you through enabling real-time data streaming for a OneDrive connection and how to monitor live streaming events within the Getvisibility platform.

Configuring permissions for an Azure App

• Login to

What is Detector and how does it work?

Detectors are features that allow users to set up alerts for certain parameters during a classification search. A user can set up a Detector to search for keywords within the entire contents of a document or file, as well as search for keyword hits within the file's pathname. It uses advanced AI and ML search techniques such as Fuzzy Word Search and Percolation to search through documents much more quickly than a traditional pattern-matching search, such as using Regular Expressions.

An example of a Detector that a user could set up is “Employee Salary”. A user might want to ensure that documents that contain this information are not publicly shared or shared internally throughout an organisation.

Registering an iManage App

• To register iManage App you need to contact iManage support by sending an email to

• Once an account is created login to

• Click on username in the upper right corner and click Control Center

Available roles