New Capability: Activity Monitoring in Data Access Security

Overview:
New Activity Monitoring and Reporting capabilities are now available in DAS. Administrators and Data Owners can capture and understand identities' access to sensitive data in real-time. Activity data is gathered across multiple applications and managed through a single pane of glass, offering comprehensive visibility. Monitored activity information includes the type of access performed which is enriched with the identity context of the actor and supplemented by data sensitivity context about accessed data assets, including the categories of data accessed, and policies that apply to it. Activities queries are available for ad hoc and scheduled reporting.

The Problem:
Administrators and business data owners must capture, track, and monitor activity on sensitive data assets across various applications under their control. This is essential for proving and auditing access control, identifying unauthorized access, and conducting security investigations to determine who accessed sensitive data, when it was accessed, and what type of actions were performed.

The Solution:
With the upcoming release, administrators and data owners can track and monitor identities’ access to data in real-time and over time on data stored in SharePoint Online and OneDrive.

Activities from various applications are accessible for investigation, search, and analytics through a single pane of glass. Activities include details about who performed the access, the type of access, and the data accessed. Activities are enriched with information about the identity of the actor, and supplemented by data sensitivity context, data categories, rules, and relevant policies. Customers can configure the retention period for activities, to have a backup to 7 years.

This is the first step in the activity and alerts monitoring initiative that will allow DAS to capture file audit events on managed systems, track access activity, trigger alerts based on the violation, and calculate the usage of access and data, helping to improve the security posture of Identity Access to Sensitive Data.

Value to Users:

Real-time Visibility: Gain instant insight into data access activities across all DAS-governed applications, starting with O365, in a single place. Execute forensics analysis to identify suspicious activity and drill-down with advance filters to refine your search.

Forensic Investigations and Reporting: Generate detailed reports for compliance audits or perform in-depth investigations into activity data on sensitive resources. Analyze activities, over time, at the identity level, and ensure actions align with organizational policies.

Identity Context Integration: Access enriched identity information, including lifecycle state, job title, and department, to better evaluate identity activities and justify access decisions during audits.

Data Classification Integration: Administrators and Data Owners can filter activities by classification policy, rule, or category, aiding in swift investigation and compliance audit. This enriched activity query helps users immediately grasp the type of data being accessed, crucial for informed decision-making during access investigations.


Comprehensive Search and Reporting: Quick live query for data access activities by actor, resource, action type, and time range, starting in real time to 6 months back, from the Forensics Activity Page. Generate and schedule automatic reports to support governance reviews and audit requirements.

Data Retention: Easily configure the period after which all activities are deleted ensuring compliance with regulatory requirements specific to customers' data characteristics. Retain activity data until deleted to retrieve on demand, to conduct thorough forensic investigations, audit trails, and compliance reporting.

 

Who is Affected:
Administrators and Business Data Owners, interested in monitoring, controlling, auditing identity access to the data they are in charge of governing. 
Important Dates:
The Activity Monitoring will generally be available starting June 30th, 2024.