Re-scan When Changing A Policy Data Pattern

Announcements

Changes to the LIVEcommunity experience are coming soon... Here's what you need to know.

Printer Friendly Page
Did you find this article helpful? Yes No
No ratings

Question

I made a change to a data pattern in a policy but previous assets that should match aren’t resulting in a new incident. Why?

Answer

Modifying a policy’s data pattern requires that you re-scan for existing assets in the SaaS applications involved. The good news is that the metadata from earlier assets has already been collected. A re-scan will match the already collected metadata to the new pattern. New assets found during a forward scan will be evaluated using the updated data pattern. 

Earlier I wrote about Prisma SaaS Default Data Patterns based on a conversation with Nick Trubic, one of our Prisma SaaS Customer Success Engineers.

Tags (5)
Register or Sign-in
Version history
Last update:
‎05-01-2020 04:41 PM
Updated by:
Contributors