[Music] foreign [Music] it's Justin thank you for watching and welcome to my house that's Justin's house in this video we're talking data loss prevention that's right in Tokyo security operations gave us a new application called Data loss prevention I haven't touched it before this is the first time I'm probably gonna make a couple videos out of this so stay tuned for more but let's just get in and cover the basics this is the new feature identify respond to and protect your data loss Channels with data loss prevention application you can see that description right there so customers financial and proprietary data health records Social Security numbers what do you do when this stuff goes missing or has a potential to go missing that's what DLP that's what data loss prevention is all about so they're letting you automate the remediation workflows related to this so if we look at the documentation site we can see this is under security operations here on the left hand side and way down here on the left we've got data loss prevention or data loss prevention incident response um and we can get in here and explore we can do look at the administration the configuration the use of it and importantly integrate with DLP applications that might be detecting data loss or potential data loss right so let's take a look at what this looks like for the workspace experience we're going to start here and then we're going to dive in in future videos into some further detail but this is the workspace so you can see it's pretty basic this is like version 1.0 maybe even a little beta e for DLP but I've got a list of open incidents by severity nice little donut chart there another one here on the right for top offenders based on open incidents notice this is listing the person's actual name so we can see that George and Paul and James and Danny and Tony and Jennifer are all kind of making the top of that list they're getting lower as you go down below just below that we got the open instance by policy I'm in one of my demo showcases so this one has a PCI Data policy and a pii data policy so those are the incidents by that particular grouping and then on the right behind my head we've got the open incidents by a scan source so you can see some example integration points live link a generic scanner the file system exchange crawler some endpoints and email endpoints so that's just some basic some demo data the graphic behind my head isn't loading up I just loaded My Demo data so I don't know if that would appear later over time because it's an aging graph but there on the right we've got the open incidents by state so some are escalated some are in review now I won't leave you without actually opening a DLP incident so you can see what it looks like so here are the critical incidents I clicked on those and we see there the number for the data loss prevention incident the policy name the state severity typical Incident Management stuff that you'd see what's not typical is some of the features that you're able to do here including this assigned incident this is the first thing that jumped out at me is you can assign the incident to me Justin or you can assign it to an analyst to look at something or someone else this one actually happens to be assigned to an end user because I was playing before I hit record and assign it to the end user so this the button you're missing there is this end user so that's something new and Incident Management actually assigning something an end user but a data loss prevention that actually makes sense maybe we want the end user to say hey was this legit did you mean to send that out to that Excel file to you know Fran over at you know acme.com um maybe you did maybe it was for business purposes so we'll get into all that later notice I can also escalate here update the state or close it let's just go ahead and open up this particular data loss prevention incident so you can see the basic structure of one so notice I've got some details some of that stuff we were looking at in the list view there but here I've got a file name it looks like some appointment details and a Word document I could have maybe from the file system retrieved things like the file owner what permissions are set up there what integration this came through of course who's assigned to it the file location the file created and the assignment group and escalation all that you got your typical note over here on the right hand side there is an additional details Tab and every time I've clicked on this in an incident it doesn't do anything so when this does something I'll make another video or when I know how to use this better but I wanted to make this so you can at least see that here's some custom attributes none are actually associated with this one and assessments there actually is no assessments I'm going to create one live on a video for you because this one actually comes with an assessment designer which I actually thought was pretty cool so I want to record that so you're able to see it but notice here that I've got just this basic information additional comments and work notes now if I were to use this escalate button up here on the upper right hand side I will get a pop-up asking me to who to escalate to and then pick a state and then the comments the state's going to be escalated obviously so we've got some communication there around that workflow if I was just to say hey I want to change the state of this particular data loss prevention incident I can click there and change the state from in review theoretically to something else um I don't know why maybe because I don't have it assigned to anybody at the moment so let's actually just assign this for fun we'll sign it to myself we'll set it is still in review um aside I'm not gonna do any assessments right now in fact I don't have any Assessments in my system at the moment um because I want to create that now let's see if we update the state yeah so I can move this from in review now to open or responded so it looked like when I was looking at that there were three basic States I'll show you those here in a second last one here on the right is this create you know I didn't show you that with my little green arrow last one is this create child incident so I can use this one to make a child incident so do you want to create a title and then I can click yes and hit submit and I assume that's going to go ahead and create that incident so that's the basic structure of a DLP incident this is the data loss prevention workspace so you can see right there the different charts and graphs and before we end the video let's just take a look at the DLP menu if this is a new application for you notice I've got some default configurations and assignment rules response due dates assessments which we'll cover in a future video instant response some chart configuration delegate configuration and there's the custom states that I wanted to click on so we could see if there's more than in review and there is looks like that interview overdue responded reported closed so I imagine I bet if I had moved this to responded then maybe I could have moved it to closed I don't know where to go look at all that information but we'll find out and and when I do of course I'll let you know some advanced settings here record level restrictions and field level restrictions so you think about data loss prevention sometimes there's sensitive data so it looks like we've got some abilities here to control the security and then the main stuff that I'll be covering in my videos here is that DLP incident menu there is an end user portal I'll cover that in a future one we were just looking at the Ops portal and the dashboard right now is blank again I just loaded My Demo data and it's an aging time based dashboard so I have a feeling we're going to need some days to go by for that to actually populate with something and again I'll record that when it comes to it so that's my intro to data loss prevention Incident Management within the security operations application in service now I hope you found this video helpful if you did please like Please Subscribe or share with somebody who you think might be interested in integrating their DLP tools into servicenow and taking advantage of the workflows and State Management and keeping track of everything in one and single platform until next time don't forget to always be learning [Music]