Exception Wizard - Severity & Action

Administrator Help | TRITON AP-DATA | Version 8.3.x

Related topics:

Custom Policy Wizard - Severity & Action

Field

Description

When the condition is matched, severity is:

Specify the severity of incidents that match this exception. This overrides the rule's severity:

Low - Incidents that match this exception are of low importance. The policy breach is minor.

Medium - Incidents that match this exception are of medium importance. The policy breach is moderate.

High - Incidents that match this exception are very important and warrant immediate attention. The policy breach is severe.

and the action plan is

By definition, exceptions override the rule's action plan. Select an action for this exception. Note that action plans are customizable. By default, they include:

Block all - Select this option if you want this policy to use the strict actions defined under Main > Policy Management > Resources > Action Plans.

Audit & notify manager - Select this option (the default) if you want this policy to use the moderate actions defined. These are a compromise between the blocking and auditing plans.

Audit only - Select this option if you want this policy to use audit incidents and not block them.

Click the

icon to edit the action plan. You can change the action for each channel if desired. Editing an action plan changes it for all the rules and exceptions that use it.

Click the

icon to create a new action plan. See Action Plans, for details.

Advanced

Click Advanced to define severity at a more granular level. For example, when there are more than 10 matches, change severity to medium and action plan to audit & notify. When there are more than 20 matches, change severity to high and action plan to block.

Select a check box and define the parameters as needed.

Define Matches

Select how matches should be calculated for this exception:

Greatest number of matched conditions. Select this option if you want the number of matches for each condition to be compared, and only the greatest number reported. For example, if there are 5 matches for the condition, ConfidentialPattern, 3 for SSN_Pattern, and 10 for MyKeyPhrases, the number of matches would be defined as 10.

Sum of all matched conditions. Select this option if you want the number of matches for each condition to be added together and the total to be reported. Given the same example as above, the number of matches would be defined as 18.