Re-scan When Changing A Policy Data Pattern

Announcements

ATTENTION Customers, All Partners and Employees: The Customer Support Portal (CSP) will be undergoing maintenance and unavailable on Saturday, November 7, 2020, from 11 am to 11 pm PST. Please read our blog for more information.

Printer Friendly Page

Question

I made a change to a data pattern in a policy but previous assets that should match aren’t resulting in a new incident. Why?

Answer

Modifying a policy’s data pattern requires that you re-scan for existing assets in the SaaS applications involved. The good news is that the metadata from earlier assets has already been collected. A re-scan will match the already collected metadata to the new pattern. New assets found during a forward scan will be evaluated using the updated data pattern. 

Earlier I wrote about Prisma SaaS Default Data Patterns based on a conversation with Nick Trubic, one of our Prisma SaaS Customer Success Engineers.

Tags (5)