Applies to: Microsoft Cloud App Security
Activity policies allow you to enforce a wide range of automated processes leveraging the app provider’s APIs. These policies enable you to monitor specific activities carried out by various users, or follow unexpectedly high rates of one certain type of activity.
After you set an activity detection policy, it starts to generate alerts - alerts are only generated on activities that occur after you create the policy.
Activity policies enable you to set custom alerts to be sent or actions to be taken when user activity is detected. For example, if you want to know every time a user tries to log on and fails 70 times in one minute, or if a user downloads 7,000 files or is logged in from Afghanistan, you can set activity alerts to be sent to yourself or to the user when these events occur. You can even suspend the user until you have time to investigate what happened.
To create a new activity policy, follow this procedure:
In the console, click on Control followed by Policies.
Click Create policy and select Activity policy.
Give your policy a name and description, if you want you can base it on a template, for more information on policy templates, see Control cloud apps with policies.
To set which actions or other metrics will trigger this policy, work with the Activity filters.
Under Activity match parameters, select whether a policy violation will be triggered when a single activity matches the filters or if a violation is only detected when a specified number of Repeated activities are detected.
If you choose Repeated activity, you can set Group matched activities per app. This will trigger a policy match only when the repeated activities occur in the same app (for example, 5 downloads from Box).
Configure the Actions that should be taken when a match is found.
Take a look at these examples:
Multiple failed logins
You can set your policy so that you receive an alert when there have been a large number of failed login attempts within a certain, relatively short, time period. To configure a policy like this, choose the appropriate activity filter in the New Activity Policy page.
Beneath the Activity filters field, configure the parameters for which the alert will be triggered.
High download rate
You can set your policy so that you receive an alert when there has been an unexpected or uncharacteristic level of downloading activity. To configure a policy like this, under Rate parameters, choose the parameters to trigger the alert.
Activity policy reference
This section provides reference details about policies, providing explanations for each policy type and the fields that can be configured for each policy.
An Activity policy is an API-based policy that enables you to monitor your organization's activities in the cloud, taking into account over 20 file metadata filters (including device type and location). Based on the policy results, notifications can be generated and users can be suspended from the cloud app.
Each policy is composed of the following parts:
Activity filters – Enable you to create very granular conditions based on metadata.
Activity match parameters – Enable you to set a threshold for the number of times an activity repeats to be considered to match the policy. Specify the number of repeated activities required to match the policy, for example, setting a policy to alert when a user performs 10 unsuccessful login attempts in a 2 minute time frame. By default, Activity match parameters, raises a match for every single activity that meet all of the activity filters.
Using Repeated activity you can set the number of repeated activities, the duration of the time frame in which the activities are counted, and even specify that all activities should be performed by the same user and in the same cloud app.
Actions – The policy provides a set of governance actions that can be automatically applied when violations are detected.