Create and test an information protection policy
Information protection policies give you a rule-based way to detect sensitive data in Jira and Confluence, so you can take action automatically or manually.
Who can do this? |
Before you begin
Start building your policy with an idea of what sensitive information the policy should detect and whether matches need human review or automatic redaction. Start narrow with a specific site or app so you can assess the results before you expand the scope.
There are three stages to setting up a policy:
Create the policy.
Test and tune the policy.
Activate the policy.
Understand how to build an information protection policy
When you create and activate a policy, you can choose to respond in two ways if a match is found:
Redact matching content. This automatically redacts the matching information without creating a violation for admin review.
Create a violation. This creates a record for an admin to review and resolve.
Once a policy is active, the scan will apply the chosen response to historical matches, including automatic redaction.
Keep in mind automatic redaction removes content without admin review, and can only be restored through the Guard Detect API within 30 days.
After 30 days, the original content is permanently deleted and can't be recovered. Test the policy in monitoring mode before activating automatic redaction.
Create a policy
Your organization may require many different detections. We suggest creating one policy for each detection and what it covers so it’s easier to track violations and tweak the policy.
To create a policy:
Go to Atlassian Administration. Select your organization if you have more than one.
Select Security policies, then Policies.
Select Create policy.
Add a name that helps you identify the policy, such as Credit card information — finance site.
Set the Scope to the organization, site, or app the policy should monitor.
Add any sites or apps the policy should exclude from within that scope.
Add a Condition, and the relevant operator, then select Next.
Choose a Detection from the available list, then set the Confidence level and Minimum count. This sets the required accuracy and the minimum detections needed for the condition to match.
Select the Control to apply when the active policy finds a match, either Redact matching content or Create a violation.
If you’re ready to test your policy, select Save and monitor. If you’d like more time to tinker, select Save as draft instead.
While your policy is in the draft state, it doesn’t scan any content.
When the policy is set to monitor it will scan content within your set scope as it's created or updated, and record any matches in the audit log. Even if the control is set, the policy won’t create any violations or redact any content while in the monitored state.
Review and refine a policy
Once you have a policy set up to monitor, you can review the matches and check the policy detects the information you want to protect.
It’s worth doing this for a period of time to get a reasonable sample. Keep in mind, the policy may require different configuration even if there are no detections found for a period of time. No results may simply mean the data doesn’t exist.
To review and refine the policy:
Go to Atlassian Administration. Select your organization if you have more than one.
Select Security policies, then Policies.
Find the relevant policy and select More actions (), then View audit log events.
Review the recorded matches and any false positives that shouldn't trigger a response.
Return to Policies and select More actions, then Edit.
Adjust the scope, exclusions, conditions, detections, confidence levels, or minimum count to address the results.
Select Save and monitor.
Let the policy run, then review the new results and repeat the adjustments until the policy matches your requirements.
By default, information protection policies monitor content when it's created or updated, not all existing content. You can monitor existing content with the Guard Premium content scan. Scan all content across your organization
Test with a narrow scope in monitoring mode, and make adjustments as you go. You can always switch to a different version of a policy. Manage policy versions and lifecycle
Activate a policy
Activate the policy when you're satisfied with its scope, matches, and response. If you've selected automatic redaction, make sure you or another admin is prepared to review unintended redactions within the 30-day restore window.
To activate the tested policy:
Go to Atlassian Administration. Select your organization if you have more than one.
Select Security policies, then Policies.
Open the policy and check that its scope, conditions, and control match the configuration you tested.
Return to Policies, select More actions () for the relevant policy, then Activate.
The active policy will now apply your chosen action (the control you’ve set) when it finds a match in newly created or updated content.
If you’ve chosen to Create a violation, matches go to the policy violations queue for review. With Redact matching content, matching information is redacted automatically.
How to review and resolve policy violations
How to automatically redact content with a policy
Was this helpful?