0
1.0.0
Xanadu, Washington DC, Vancouver
An integration between ServiceNow's Data Loss Prevention Incident Response product (DLP-IR) and vendors who provide their DLP alerts information using the Internet Content Adaption Protocol (ICAP).
- Ingestion of DLP Alerts from Amazon S3:
- Users would be able to configure and schedule the ingestion of DLP alerts from specified Amazon S3 buckets. This includes the capability to perform delta imports to ensure only new or modified data is ingested.
- Display DLP Alerts in the DLP Workspace:
- Once alerts are ingested, they should be displayed in the DLP workspace by providing the key details on each alert such as the match content, alert severity, and relevant metadata.
- Evidence File Download:
- The system would allow users to download associated evidence files directly from the DLP workspace for further investigation or review.
- Automation and Response Workflows:
- Advanced workflow automation should be available for handling alerts, enabling users to apply automatic responses based on predefined criteria. This might include actions like alert escalation, notifications, or enforcement policies.
- Advanced response options:
- These could include remediation actions such as blocking or quarantining sensitive data, or sending out alerts to stakeholders.
- Dashboards and Data Trends:
- Users should be able to visualize ingested data in the DLP workspace through dashboards and trend reports. This would help track the number and type of DLP incidents over time, offering insights into potential data loss patterns or vulnerabilities.
New:
- Users would be able to configure and schedule the ingestion of DLP alerts from specified Amazon S3 buckets. This includes the capability to perform delta imports to ensure only new or modified data is ingested.
- Display of DLP Alerts in the DLP Workspace.
- The system would allow users to download associated evidence files directly from the DLP workspace for further investigation or review.
- Advanced workflow automation should be available for handling alerts, enabling users to apply automatic responses based on predefined criteria. This might include actions like alert escalation, notifications, or enforcement policies.
- Advanced response options.
- Required plugins and products
- Dependencies
- Properties that need to be created or set to activate the content pack
- Affected business rules
- Affected script includes
- .jar files that need to get uploaded, if applicable