Enable and Configure Automatic Remediation for SaaS API DLP in Slack and ServiceNow

Available Languages

Download Options

  • PDF     (4.2 KB)
    View with Adobe Reader on a variety of devices
  • ePub     (84.9 KB)
    View in various apps on iPhone, iPad, Android, Sony Reader, or Windows Phone
  • Mobi (Kindle)     (70.2 KB)
    View on Kindle device or Kindle app on multiple devices
Updated:October 23, 2025
Document ID:225277

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Contents

Introduction

This document describes how to enable and configure automatic remediation for SaaS API DLP in Slack and ServiceNow tenants.

Overview

You can now discover and automatically remediate sensitive data exposure in your Slack and ServiceNow tenants. This helps you maintain compliance and prevent the exposure of sensitive data, such as intellectual property or credentials for other systems.

Authorize New Tenants for Supported Platforms

As an administrator, you can authenticate new tenants for Slack and ServiceNow using the SaaS API Data Loss Prevention (DLP) feature in the Umbrella dashboard.

  1. Go toADMIN > AUTHENTICATION > PLATFORMSin the Umbrella dashboard.
  2. Authenticate the new tenant as prompted.

Automatic Remediation Supported by SaaS API DLP

  • ServiceNow:
    SaaS API DLP supports automatic quarantine. The quarantined file is saved in the Cisco Quarantine table. Only the administrator who authenticated the tenant can access this table.

  • Slack:
    SaaS API DLP supports automatic deletion of files and messages.

Configure Automatic Remediation for Infected Files

As an administrator, you can configure SaaS API DLP to automatically remediate sensitive data exposure.

Set the response action in the SaaS API DLP rule:

  1. In the Umbrella dashboard, go toPOLICIES > MANAGEMENT > DATA LOSS PREVENTION POLICY.
  2. ClickADD RULE.
  3. SelectSAAS API RULE.
  4. Set the desiredACTIONin the Response Action section to enable automatic remediation.

Find More Information

Refer to the Umbrella documentation for detailed guidance.

Revision History

Revision Publish Date Comments
1.0
23-Oct-2025
Initial Release
TAC Authored

Contributed by Cisco Engineers

  • TAC

Was this Document Helpful?

FeedbackFeedback

Contact Cisco

This Document Applies to These Products