SBAC for DLP add-on

[SeanDeHarris]

Hello All, 

Would SBAC also works for DLP (add-on) module events?

We wou ld enable SBAC for those Endpoints with DLP enable by department. Then allow each department head as the Data Security Reviewer to view their own DLP events.

Possible to do so?

Thanks,

SDH

[natasha052gandhi]

Hello,

Yes, this should be possible, but it depends on how DLP events are mapped with SBAC attributes. 

If the DLP events include the required details , you should be able to configure SBAC so each department head can review only their own department’s DLP events.

[susekar · Accepted solution]

Hello @SeanDeHarris ,

Greetings for the day.

Yes, Scope-Based Access Control (SBAC) works for Endpoint DLP (add-on) module events, but its enforcement varies significantly depending on which part of the console the department head is viewing.

While SBAC can successfully restrict visibility for DLP-related incidents and alerts, it currently has a major limitation regarding high-level dashboards like the Data Security Command Center.

1. Visibility of DLP Events

• Endpoint DLP events are assigned to the Data Security domain.SBAC is supported in Incidents and Alerts.
• Assign department heads an SBAC scope containing their Endpoint Groups/Tags and the Data Security domain.Incidents, Alerts, and Data Security Issues will show only events from endpoints within their assigned scope.

2. Dashboard Limitations

• Data Security Command Center and its OOTB widgets do not currently respect SBAC.They display tenant-wide aggregate data.To prevent organization-wide visibility, avoid granting access to global Command Center dashboards.
• Use custom dashboards with SBAC-compatible widgets instead.

3. Required Role Configuration

• Alerts & Incidents: View
• Data Security: Required permissions
• Do not assign Account Administrator or Instance Administrator roles, as they bypass SBAC.

Implementation Steps:

1. Create Endpoint Groups by department.
2. Create the Data Security Reviewer role with View access to Incidents, Alerts, and Data Security.
3. Assign each department head the appropriate Endpoint Group and Data Security scope.
4. Enable SBAC under Settings > Configurations > General > Server Settings > Scoped Server Access.
5. For Cortex XDR 4.2+, Asset-led Access Control can also be used for supported dashboard widgets.

For more explanations/configuration assistance needed on this,I would request you to reach your Accounts team on this.

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution".

Thanks & Regards,
S. Subashkar Sekar

[SeanDeHarris]

Thank you so much, this is very useful. 
I wish this info would be included in the Cortex doc in the near future.