 | ||
| About remediation workflows | ||
|---|---|---|
| Prev | Configuring remediation workflows | Next |
In large storage environments, it can become difficult to assign the responsibility of remediating data resources to data owners and custodians. Security and storage administrators have to manually inform data owners about issues with the resources that they own. Also, it can be tedious to track remediation actions on such resources.
Remediation workflows provide an easy way to fan out remediation tasks among configured custodians and data owners. The custodians are responsible for the data resources and can take a decision about the best way to remediate them. To understand how custodians are assigned in Data Insight, refer to the Veritas Data Insight User's Guide.
You can use workflows to define a process to distribute remediation tasks to custodians. You can create the following workflows for different remediation tasks:
Entitlement Review
Review the user permissions on the folders that the custodians are responsible for and attest the permissions or suggest changes. The entitlement information for this workflow is generated by the Entitlement Review report.
You can send the change request to a ticketing system or Identity and Access Management (IAM) tool, or use custom scripts to remediate the permissions.
Data Loss Prevention (DLP) Incident Remediation
View policy violations and take action on the files that violate policies. The policy information is pulled into Data Insight from Symantec Data Loss Prevention (DLP). The actions are Smart Response rules defined by DLP administrators. DLP uses the Smart Response rules to remediate the resources that violate configured DLP policies.
Data Insight uses two DLP Web services for incident remediation - the Response Rules Listing Service and the Response Rule Execution Service. The Response Rule Listing Service provides a list of available response rules in DLP, such as delete or quarantine, for a given incident. The Response Rule Execution Service takes the response rule requests submitted by users from the Self-Service Portal and executes them in DLP. By default, the Response Rule Execution Service is disabled. You must enable the service to allow the portal users to remediate incidents.
For more information about DLP incidents, see the Symantec Data Loss Prevention Administrator's Guide.
Ownership Confirmation
Confirm the ownership of files and folders in your storage environment.
Records Classification
Classify the sensitive files that must be retained for a legally mandated period. The workflow helps you classify files based on their business value and manage the life cycle of sensitive documents by applying data management rules to the classified data.
You can choose to archive the files that are marked as record and apply retention categories that define how long the files must be stored before being deleted. The files that are marked as record are retained based on the file classification policies that they violate.
You can use the workflow to trigger automatic actions only if your organization uses Enterprise Vault™ to archive data and if Enterprise Vault is configured in Data Insight.
Depending on the type of workflow, the custodian may perform the following actions:
Once you submit a workflow from the Data Insight console, the custodians receive an email notification with a link to the Self-Service Portal. They can log in to the portal, choose the necessary remediation actions, and submit the same for execution by the DLP Enforce Server, Enterprise Vault server, or the Data Insight Management Server, depending on the type of workflow.
