XSIAM - Data Patterns

[oatienza86]

Hi.

Please, a question about Data Patterns in Cortex XSIAM. Once the connection from the Broker VM to the Windows server (SMB) is configured, the connection is verified and displayed under Modules -> Data Security -> Storage Buckets, how is it linked to previously created Data Patterns and Data Profiles?.

Thank you in advanced.

Regards.

[susekar · Accepted solution]

Hello  @oatienza86 ,

Greetings for the day.

In Cortex XSIAM, the linkage between your configured Storage Buckets (onboarded via the Broker VM SMB connection) and your Data Patterns or Data Profiles is established through the Data Classification engine.

There is no manual "mapping" step where you assign specific profiles to specific buckets; instead, the system utilizes all enabled patterns and profiles globally during the scanning process once classification is activated for the asset.

1. Enabling Classification on the SMB Connection:

For the linkage to take effect, you must explicitly enable the classification feature within the Broker VM applet settings for that specific SMB connection:

• Navigate to Settings → Configurations → Data Broker → Broker VMs.
• Locate the DSPM Fileshare applet and click to edit the configuration.
• In the File Share Connection list, find your SMB connection.
• Turn on the Classification toggle.
• Select the scan cadence (e.g., scan every day, week, or a custom interval) and click Save.

Once enabled, Cortex XSIAM will scan a sample of files (by default, up to 2,500 random files) during each scheduled scan to identify sensitive records.

2. How Data Patterns and Profiles are Applied:

The "link" is automated based on your global Data Classification configuration:

• Global Pool of Patterns: The scanning engine uses all enabled data patterns found under Settings → Configurations → Data Classification → Data Patterns to inspect the files in your storage buckets.
• Automatic Categorization: If a file matches a pattern (e.g., a Credit Card Number), it is automatically associated with the corresponding Data Profile (e.g., PCI or Financial) that contains that pattern.
• Customization: If you want to exclude certain types of data from being flagged in your SMB shares, you must disable those specific Data Patterns in the Data Classification management screen.

3. Viewing the Linked Results

Once the scan is complete, the linkage becomes visible in the Data Security module:

• Navigate to Modules → Data Security → Storage Buckets.
• Select the bucket corresponding to your SMB share.
• The Data or Object tabs will display which Data Patterns and Profiles were discovered within the files of that specific bucket.

If classification results are not appearing, ensure that the Broker VM has the necessary permissions to read the files on the SMB share and that the "Classification" toggle is correctly saved in the Broker VM settings.

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution".

Thanks & Regards,
S. Subashkar Sekar

[oatienza86]

Hello Susekar.

Thank you very much for your response.

After following all the steps and knowing that the user has read permissions on the files, do you have any clue why there are no matches with either the patterns or the created profiles, even though the files themselves contain the pattern searched?.

Regards.