You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/external-attack-surface-management/policy-engine.md
+11-11Lines changed: 11 additions & 11 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,6 +1,6 @@
1
1
---
2
2
title: Policy engine automation
3
-
description: Automate inventory curation by leveraging the policy engine to proactively implement certain actions based on pre-determined parameters.
3
+
description: Automate inventory curation by leveraging the policy engine to proactively implement certain actions based on predetermined parameters.
4
4
author: danielledennis
5
5
ms.author: dandennis
6
6
ms.service: defender-easm
@@ -9,47 +9,47 @@ ms.topic: how-to
9
9
---
10
10
11
11
# Policy engine automation
12
-
The policy engine enables Defender EASM users to automate certain actions based on pre-determined parameters. You can elect to label assets or change their states based on highly flexible query parameters to automate the curation of your attack surface. Once defined, policies run automatically to ensure that your inventory is categorized according to your specific needs on a recurrent basis. With the policy engine, you can apply business context to your inventory in bulk with minimal manual effort with the following actions:
12
+
The policy engine enables Defender External Attack Surface Management (Defender EASM) users to automate certain actions based on predetermined parameters. You can elect to label assets or change their states based on highly flexible query parameters to automate the curation of your attack surface. Once defined, policies run automatically to ensure that your inventory is categorized according to your specific needs on a recurrent basis. With the policy engine, you can apply business context to your inventory in bulk with minimal manual effort with the following actions:
13
13
- Add or remove labels
14
14
- Set an external ID
15
15
- Set an asset state
16
16
- Remove from inventory
17
17
18
18
## Accessing and understanding policies
19
-
To quickly access policy information, navigate to the dedicated Policies page in your Defender EASM resource. This page can be found under the “Manage” section of the left-hand navigation pane.
19
+
To quickly access policy information, navigate to the dedicated Policies page in your Defender EASM resource. This page can be found under the **Manage** section of the left-hand navigation pane.
20
20
21
21

22
22
23
-
On this page, you will see a list of all active policies in your Defender EASM resource. This list view provides immediate access to key information about each policy, including:
23
+
This page displays a list of all active policies in your Defender EASM resource. This list view provides immediate access to key information about each policy, including:
24
24
-**Policy:** the designated name for the policy.
25
-
-**Description:** the designated description for the policy, providing additional context about the configuration and intended business value.
25
+
-**Description:** the designated description for the policy, providing more context about the configuration and intended business value.
26
26
-**Query:** the underlying quer(ies) that power each policy. Policy actions are applied specifically to assets that match these configured filter parameters.
27
27
-**Action:** a description of the action that takes place when assets match the designated filter parameters. Actions include: add or remove labels, set state, set external ID, and remove from inventory.
28
28
-**Created by:** the email alias of the Defender EASM user who created the policy.
29
29
-**Created on:** the date that the policy was first created.
30
-
-**Affected assets:** a count of all assets that have been updated in accordance with the policy. Clicking the numerical count will route you to the inventory list view, filtered to display only the assets that match the underlying quer(ies) that power the policy.
30
+
-**Affected assets:** a count of all assets that were updated in accordance with the policy. Clicking the numerical count routes you to the inventory list view, filtered to display only the assets that match the underlying quer(ies) that power the policy.
31
31
32
32

33
33
34
34
## Create a policy
35
35
36
-
1. Navigate to the Policies page by selecting **Policies** from the Manage section of the left-hand navigation pane within your Defender EASM resource.
36
+
1. Navigate to the Policies page by selecting **Policies** from the **Manage** section of the left-hand navigation pane within your Defender EASM resource.
37
37
2. Select **+ Add Policy**. This action opens a right-hand pane to configure the policy.
38
38
39
39

40
40
41
-
3. Complete the listed fields to create your policy. First provide a name and description that explain the business context for the policy. Note that you cannot edit the name of the policy once it has been created; while all other fields can be adjusted later, you will need to create a new policy if you wish to change the name.
42
-
4. Then select the query that will trigger the policy; any assets that match the query parameters will be automatically updated with the designated action. For instance, you may want to label all expiring entities (e.g. domains, SSL certificates) with a “needs renewal” label. You can create a saved query that searches for metadata that expires within 30 days or has already expired. You can then designate that the system applies a “needs renewal” label to all applicable assets. You can either select to power the policy with a previously saved filter, or you can create a new query. All saved queries will be visible within the dropdown, or select Create new saved query to configure new filter parameters. If you would like to view the assets that match your query before setting up a policy, it is recommended that you first create a saved query from the Inventory page.
41
+
3. Complete the listed fields to create your policy. First provide a name and description that explain the business context for the policy. You can't edit the name of the policy once it is created. While all other fields can be adjusted later, you will need to create a new policy if you wish to change the name.
42
+
4. Then select the query that triggers the policy; any assets that match the query parameters are automatically updated with the designated action. For instance, you may want to label all expiring entities (e.g. domains, SSL certificates) with a "needs renewal" label. You can create a saved query that searches for metadata that expires within 30 days or is already expired. You can then designate that the system applies a "needs renewal" label to all applicable assets. You can either select to power the policy with a previously saved filter, or you can create a new query. All saved queries are visible within the dropdown, or select Create new saved query to configure new filter parameters. If you would like to view the assets that match your query before setting up a policy, it is recommended that you first create a saved query from the Inventory page.
43
43
5. Once all fields are configured, select Add to create your policy.
44
44
45
-
Please note that it will take newly created policies up to one week to apply changes to your inventory. Once the changes are implemented, you will see them reflected in the Change history tab. You will also be able to see the impacted assets when using the “Policy name” filter on your inventory, and the Policies page will list an accurate count of impacted assets. Pre-existing policies will update any newly applicable assets within 5-7 days of the last run.
45
+
It takes newly created policies up to one week to apply changes to your inventory. Once the changes are implemented, you'll see them reflected in the Change history tab. You will also be able to see the impacted assets when using the Policy name filter on your inventory, and the Policies page lists an accurate count of impacted assets. Pre-existing policies update any newly applicable assets within 5-7 days of the last run.
46
46
47
47
48
48
## Edit or delete policies
49
49
Users can edit policies individually or delete one or more policies simultaneously.
50
50
51
51
### Edit policies
52
-
To edit a policy, click on the policy name from the list view. This opens a right-hand pane that enables you to edit the policy configuration. Users cannot edit the name of their policy, but all other fields are adjustable. Once you have made your intended changes, select Update to save the policy.
52
+
To edit a policy, click on the policy name from the list view. This opens a right-hand pane that enables you to edit the policy configuration. Users can't edit the name of their policy, but all other fields are adjustable. Once you make your intended changes, select Update to save the policy.
53
53
54
54
### Delete policies
55
55
You can delete policies individually or in bulk. From the main Policies page, select the polic(ies) that you’d like to delete by clicking the checkbox next to the policy name. Select “Remove policy” and confirm the removal. Deleting a policy will not revert any previously implemented actions, but it will stop the automated actions from taking place in the future. If you need to make one-time changes to the assets impacted by the policy, you can leverage the same saved query underlying the policy from the Inventory page to revert the changes.
0 commit comments