Creating new policies

Datto SaaS Defense uses a role based access control (RBAC) strategy regarding client policies. This means the role assigned to a user dictates the specific rights and restrictions the user has when working with client policies.

This is the role hierarchy that applies to client policies:

• Partner
• Client

A quick way to configure a policy with multiple trigger values is by uploading a comma-separated values (CSV) file. A CSV file is a text file where each row in the file is a record ending with a line break. You can upload a CSV file that includes each trigger value when creating email or link policies.

A CSV file is created using a text editor. It is required that each trigger value is formatted correctly based on the selected trigger. Each trigger value must be entered on its own row ending with a line break. The file must be smaller than 5 MB and saved with a .csv extension.

The table shows trigger value examples for each trigger.

When you upload a CSV file, a dialog box is displayed so you can verify each trigger value and its status. An error is indicated for any trigger values that are not formatted correctly. You can decide whether to commit to adding the trigger values to the trigger or discard them.

When you commit to adding the trigger values, any trigger values containing errors will not be added to the policy.

The search box allows you to search for a specific trigger value or status.

NOTE   When uploading a CSV file, if the file is not smaller than 5 MB or does not have a .csv extension, an error message is displayed. As a result, the dialog box conveying each trigger value and its status is not displayed.

NOTE  A trigger and a value are required to be added before a CSV file can be uploaded for an email policy. This is not required for a link policy. The steps for uploading a CSV file are included in the procedures Creating a new email policy and Creating a new link policy.

The email Header trigger is commonly used to allowlist an email based on its Header and Value. This is often done when you want to conduct an email phishing test with your client end users. By sending mock phishing emails, you help end users understand what a phishing attack looks like and train them to avoid clicking malicious links. A phishing simulation provides end users with real-life experience without any risk to the organization.

To ensure SaaS Defense does not interfere with these campaigns, you can allowlist the header and/or value provided by your phishing campaign. SaaS Defense will ignore those emails to ensure the most accurate results.

Datto Saas Defense needs to be made aware of this address so it allows the emails to be received by the end users. Otherwise, the emails will be inspected and blocked. During inspection, SaaS Defense clicks the links included in the emails to identify the destination sites. Therefore, the phishing campaign will assume that the end users clicked the links, producing inaccurate campaign results.

When creating an email policy, you can enter an email address in the username@domain format, but another option is to use a regular expression (regex). With a regex, you create a text string pattern that SaaS Defense compares to an address (i.e., From Address, Return Path Address, To Address) included in an incoming email.

Consider a Restricted Emails By From Address Rule example where the email address is specified using the regex: je[0-9]*@badwebsite.com. Let's analyze each component in the rule.

• je: From Address starts with the letters je.
• [0-9]: includes a number between 0 and 9.
• *: infinite times. Any number between 0 and 9 can appear an infinite number of times.
• @badwebsite.com: the badwebsite.com domain.

An incoming email whose From Address matches all of the Restricted Emails By From Address Rule criteria is blocked or flagged.

NOTE  A regex can include a maximum of 30 characters.

1. On the Main menu, click Settings.
   
2. Click Create a New Policy.
   
3. In the Policy Type section:
1. For the Action toggle:
   • To create a policy to allow access to content, click Allow.
   • To create a policy to block access to content, click Block.
2. In the Policy Type list, select Email.
   
4. In the Email Triggers section:
   1. In the New Trigger list, select the applicable trigger.
      
   2. In the Trigger Value field, enter the value.
      
      Note: The email address can include a maximum of 30 characters.
   3. Click Add Trigger.
      
      
      The trigger is listed in the Email Triggers section.
      
   4. To add another trigger value:
      1. Click to the right of the listed trigger value and enter another trigger value.
         
      2. Press Enter to add the trigger.
         
   5. To add multiple trigger values by uploading a CSV file:
      
      1. Next to the trigger you just added, click the upload csv icon.
         
      2. Click Upload CSV.
         
      3. Navigate to and open the applicable CSV file.
      4. Perform one of the following:
         • To commit the trigger values to the trigger, click Save Changed.
           
           The trigger values are added to the trigger.
           
         • To discard the trigger values, click Discard.
           
   6. To add another trigger, repeat steps 4a through 4c.
      In this example, the Subject trigger has been added to our email policy.
      

NOTE  If desired, you can upload a CSV file to the trigger added in step 4f.

5. In the Services section, select the services for which this policy will apply. If applicable, you can select more than one service.
   

6. This step applies to partners only. In the Clients section, All Clients is selected by default. To apply the policy to specific clients only:

   1. Click Manage Clients.
      
   2. In the Client list, clear the Client check box.
      
   3. Select the desired clients.
      

   NOTE  You can search for clients using the search box.

   4. Click Save. The clients selected are listed in the Clients section.
      

   NOTE  Include Future Clients is selected by default. The policy will automatically apply to every new client added to the policy's services. If that is not desired, clear the check box.

7. At the bottom of the page, click Save.

NOTE  If you decide not to create the new policy, click Discard at any point prior to clicking Save.

8. Verify the new policy is listed as the first record in the Policies table. Click the policy to display trigger details.
   

1. On the Main menu, click Settings.
   
2. Click Create a New Policy.
   
3. In the Policy Type section:
1. For the Action toggle:
   • To create a policy to allow access to content, click Allow.
   • To create a policy to block access to content, click Block.
2. In the Policy Type list, select File.
   
4. In the File Triggers section:
   1. Click the File Extension field.
   2. In the list, select the check box of each desired file extension.
      
   3. To filter the list:
      1. In the File Extension field, enter the first letter of the desired extension. The list filters showing only the file extensions that include the letter you entered.
         
      2. Select the check box of each desired file extension.
   4. To close the list, click an area outside of the list box.

5. In the Services section, select the services for which this policy will apply. You can select more than one service.
   

6. This step applies to partners only. In the Clients section, All Clients is selected by default. To apply the policy to specific clients only:

   1. Click Manage Clients.
      
   2. In the Client list, clear the Client check box.
      
   3. Select the desired clients.
      

   NOTE  You can search for clients using the search box.

   4. Click Save. The clients selected are listed in the Clients section.
      

   NOTE  Include Future Clients is selected by default. The policy will automatically apply to every new client added to the policy's services. If that is not desired, clear the check box.

7. At the bottom of the page, click Save.

NOTE  If you decide not to create the new policy, click Discard at any point prior to clicking Save.

8. Verify the new policy is listed as the first record in the Policies table. Click the policy to display trigger details.
   

1. On the Main menu, click Settings.
   
2. Click Create a New Policy.
   
3. In the Policy Type section:
1. For the Action toggle:
   • To create a policy to allow access to content, click Allow.
   • To create a policy to block access to content, click Block.
2. In the Policy Type list, select Link.
   
4. To add trigger values one at a time:
   1. In the URL field, enter a valid URL. A regex cannot be used.
      
   2. Press Enter.
   3. To add another URL, repeat steps 4a and 4b.
5. To add multiple trigger values by uploading a CSV file:
   
   1. Next to the URL field, click the upload csv icon.
      
      
   2. Click Upload CSV.
      
   3. Navigate to and open the applicable CSV file.
   4. Perform one of the following:
      • To commit the trigger values to the trigger, click Save Changed.
        
        The trigger values are added to the trigger.
        
      • To discard the trigger values, click Discard.
        
6. In the Services section, select the services for which this policy will apply. You can select more than one service.
   

7. This step applies to partners only. In the Clients section, All Clients is selected by default. To apply the policy to specific clients only:

   1. Click Manage Clients.
      
   2. In the Client list, clear the Client check box.
      
   3. Select the desired clients.
      

   NOTE  You can search for clients using the search box.

   4. Click Save. The clients selected are listed in the Clients section.
      

   NOTE  Include Future Clients is selected by default. The policy will automatically apply to every new client added to the policy's services. If that is not desired, clear the check box.

8. At the bottom of the page, click Save.

NOTE  If you decide not to create the new policy, click Discard at any point prior to clicking Save.

9. Verify the new policy is listed as the first record in the Policies table. Click the policy to display trigger details.
   

You are allowed to edit only policies that you created. You can edit a policy's trigger criteria, services, and clients. However, the policy's Action and Policy Type values cannot be changed. The steps for editing a policy are the same for all policy types, except where noted.

1. In the Policies table, at the end of the row for the policy you want to edit, click the Edit icon .

2. To add another trigger value, perform the steps that apply to the Policy Type you are editing.

NOTE  For an email policy, you can add a new trigger by following the steps in the Creating a new Email policy section.

3. To delete a trigger value, click the X.
   
4. To delete an existing trigger, click the Remove icon.
   
5. To edit services, click the appropriate service icon to select a new service or deselect a previously selected service.
6. This step applies to partners only. To edit clients:
   1. Click Manage Clients.
   2. Select or clear the applicable check boxes.
   3. Click Save.

NOTE  If you don't want to commit to the changes you have made, click Discard at any point prior to clicking Save.

7. At the bottom of the page, click Save.
8. Verify the edits in the Policies table.

You are allowed to delete only policies that you created.

1. In the Policies table, at the end of the row for the policy you want to delete, click the Remove icon .
2. In the Remove Policy confirmation box, click Remove.
3. Verify the policy is no longer listed in the Policies table.

A policy can be edited only by the user that created the policy. However, with the View As feature, a partner can assume a client role and act on behalf of the original policy creator. Therefore, a partner can create, edit, and delete policies on behalf of a client.

There are two situations in which the View As feature can be used:

• The partner's Policies page includes a policy that was created by a client, as indicated by the View Policy icon . The partner can use View As to edit the policy on behalf of the client.
• The partner would like to assume the role of a specific client, perhaps to list just the policies that apply to that client. The partner has the ability to edit if needed.

The View As feature is a convenient way for partners to provide direct support to their clients. In the Partner procedures section, see the procedure Using View As.

It is recommended that you are comfortable with the procedures for creating and editing policies prior to using View As.

NOTE  The View As feature is available for partners only.

To edit a policy listed on the Policies page using View As:

1. On the Main menu, click Settings.
   
2. On the Policy page, click the desired record. The record should include the View Policy icon in the last column.
3. Click Edit Policy with "View As."
   
   
4. The Edit Policy page is displayed. The View As box changes to the name of the organization that originally created the policy.
   
5. Make the desired edits.

To assume a role lower in your hierarchy using View As:

1. On the Main menu, click Settings.
   
2. By default, your organization is selected in the View As list. Click your organization's name.
   
3. In the list, select the applicable organization.
   

NOTE  You can use the search box to find a specific client. The list filters as you enter text.

4. View As updates to show the selected organization.
   
   Only the policies for the selected organization are displayed in the Policies table.
5. To create a new policy for the organization, click Create a New Policy. Perform the steps for the applicable policy type.
6. To edit a policy, click the desired record.
   1. Click Edit Policy with "View As."
      
   2. The Edit Policy page is displayed. The View As box changes to the name of your organization since it created the policy. Make the desired edits.