Skip to content

Commit 5312d90

Browse files
Update policy-engine.md
1 parent 227727b commit 5312d90

File tree

1 file changed

+11
-11
lines changed

1 file changed

+11
-11
lines changed

articles/external-attack-surface-management/policy-engine.md

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
---
22
title: Policy engine automation
3-
description: Automate inventory curation by leveraging the policy engine to proactively implement certain actions based on pre-determined parameters.
3+
description: Automate inventory curation by leveraging the policy engine to proactively implement certain actions based on predetermined parameters.
44
author: danielledennis
55
ms.author: dandennis
66
ms.service: defender-easm
@@ -9,47 +9,47 @@ ms.topic: how-to
99
---
1010

1111
# Policy engine automation
12-
The policy engine enables Defender EASM users to automate certain actions based on pre-determined parameters. You can elect to label assets or change their states based on highly flexible query parameters to automate the curation of your attack surface. Once defined, policies run automatically to ensure that your inventory is categorized according to your specific needs on a recurrent basis.  With the policy engine, you can apply business context to your inventory in bulk with minimal manual effort with the following actions:
12+
The policy engine enables Defender External Attack Surface Management (Defender EASM) users to automate certain actions based on predetermined parameters. You can elect to label assets or change their states based on highly flexible query parameters to automate the curation of your attack surface. Once defined, policies run automatically to ensure that your inventory is categorized according to your specific needs on a recurrent basis.  With the policy engine, you can apply business context to your inventory in bulk with minimal manual effort with the following actions:
1313
- Add or remove labels
1414
- Set an external ID
1515
- Set an asset state
1616
- Remove from inventory
1717

1818
## Accessing and understanding policies
19-
To quickly access policy information, navigate to the dedicated Policies page in your Defender EASM resource. This page can be found under the Manage section of the left-hand navigation pane.
19+
To quickly access policy information, navigate to the dedicated Policies page in your Defender EASM resource. This page can be found under the **Manage** section of the left-hand navigation pane.
2020

2121
![Screenshot of Policies page with left-hand navigation option highlighted.](media/policies-1.png)
2222

23-
On this page, you will see a list of all active policies in your Defender EASM resource. This list view provides immediate access to key information about each policy, including:
23+
This page displays a list of all active policies in your Defender EASM resource. This list view provides immediate access to key information about each policy, including:
2424
- **Policy:** the designated name for the policy.
25-
- **Description:** the designated description for the policy, providing additional context about the configuration and intended business value.
25+
- **Description:** the designated description for the policy, providing more context about the configuration and intended business value.
2626
- **Query:** the underlying quer(ies) that power each policy. Policy actions are applied specifically to assets that match these configured filter parameters.
2727
- **Action:** a description of the action that takes place when assets match the designated filter parameters. Actions include: add or remove labels, set state, set external ID, and remove from inventory.
2828
- **Created by:** the email alias of the Defender EASM user who created the policy.
2929
- **Created on:** the date that the policy was first created.
30-
- **Affected assets:** a count of all assets that have been updated in accordance with the policy. Clicking the numerical count will route you to the inventory list view, filtered to display only the assets that match the underlying quer(ies) that power the policy.
30+
- **Affected assets:** a count of all assets that were updated in accordance with the policy. Clicking the numerical count routes you to the inventory list view, filtered to display only the assets that match the underlying quer(ies) that power the policy.
3131

3232
![Screenshot of visible metadata in columns on Policies page.](media/policies-2.png)
3333

3434
## Create a policy
3535

36-
1. Navigate to the Policies page by selecting **Policies** from the Manage section of the left-hand navigation pane within your Defender EASM resource.
36+
1. Navigate to the Policies page by selecting **Policies** from the **Manage** section of the left-hand navigation pane within your Defender EASM resource.
3737
2. Select **+ Add Policy**. This action opens a right-hand pane to configure the policy.
3838

3939
![Screenshot of Policies page with Add Policies button highlighted and policy configuration panel open.](media/policies-3.png)
4040

41-
3. Complete the listed fields to create your policy. First provide a name and description that explain the business context for the policy. Note that you cannot edit the name of the policy once it has been created; while all other fields can be adjusted later, you will need to create a new policy if you wish to change the name.
42-
4. Then select the query that will trigger the policy; any assets that match the query parameters will be automatically updated with the designated action. For instance, you may want to label all expiring entities (e.g. domains, SSL certificates) with a needs renewal label. You can create a saved query that searches for metadata that expires within 30 days or has already expired. You can then designate that the system applies a needs renewal label to all applicable assets. You can either select to power the policy with a previously saved filter, or you can create a new query. All saved queries will be visible within the dropdown, or select Create new saved query to configure new filter parameters. If you would like to view the assets that match your query before setting up a policy, it is recommended that you first create a saved query from the Inventory page.
41+
3. Complete the listed fields to create your policy. First provide a name and description that explain the business context for the policy. You can't edit the name of the policy once it is created. While all other fields can be adjusted later, you will need to create a new policy if you wish to change the name.
42+
4. Then select the query that triggers the policy; any assets that match the query parameters are automatically updated with the designated action. For instance, you may want to label all expiring entities (e.g. domains, SSL certificates) with a "needs renewal" label. You can create a saved query that searches for metadata that expires within 30 days or is already expired. You can then designate that the system applies a "needs renewal" label to all applicable assets. You can either select to power the policy with a previously saved filter, or you can create a new query. All saved queries are visible within the dropdown, or select Create new saved query to configure new filter parameters. If you would like to view the assets that match your query before setting up a policy, it is recommended that you first create a saved query from the Inventory page.
4343
5. Once all fields are configured, select Add to create your policy.
4444

45-
Please note that it will take newly created policies up to one week to apply changes to your inventory. Once the changes are implemented, you will see them reflected in the Change history tab. You will also be able to see the impacted assets when using the Policy name filter on your inventory, and the Policies page will list an accurate count of impacted assets. Pre-existing policies will update any newly applicable assets within 5-7 days of the last run.
45+
It takes newly created policies up to one week to apply changes to your inventory. Once the changes are implemented, you'll see them reflected in the Change history tab. You will also be able to see the impacted assets when using the Policy name filter on your inventory, and the Policies page lists an accurate count of impacted assets. Pre-existing policies update any newly applicable assets within 5-7 days of the last run.
4646

4747

4848
## Edit or delete policies
4949
Users can edit policies individually or delete one or more policies simultaneously.
5050

5151
### Edit policies
52-
To edit a policy, click on the policy name from the list view. This opens a right-hand pane that enables you to edit the policy configuration. Users cannot edit the name of their policy, but all other fields are adjustable. Once you have made your intended changes, select Update to save the policy.
52+
To edit a policy, click on the policy name from the list view. This opens a right-hand pane that enables you to edit the policy configuration. Users can't edit the name of their policy, but all other fields are adjustable. Once you make your intended changes, select Update to save the policy.
5353

5454
### Delete policies
5555
You can delete policies individually or in bulk. From the main Policies page, select the polic(ies) that you’d like to delete by clicking the checkbox next to the policy name. Select “Remove policy” and confirm the removal. Deleting a policy will not revert any previously implemented actions, but it will stop the automated actions from taking place in the future. If you need to make one-time changes to the assets impacted by the policy, you can leverage the same saved query underlying the policy from the Inventory page to revert the changes.

0 commit comments

Comments
 (0)