If you're having trouble at any stage please contact us at support@skyformation.com.
Preface
Box is a service to store, manage and share files as photos and documents. Box service is delivered as a cloud service. Box helps organizations move faster with infinite scalability and lower cost for their file sharing needs.
But at the same time, the public cloud Software as a Service (SaaS) model presents the organization with new security challenges.
The main challenges and needs are to:
- Get and retain full audit of activities in Box account
- Retrieve the Box account activities as users’ access to file/folders, files/folder sharing activities and scope, file/folders download and more.
- The granular activities should be available at the organization’s central log or event management system for compliance, investigation or forensic needs.
- Detect security threats and policy violations
What is it
SkyFormation Cloud Connector for Box, is part of the SkyFormation Cloud Connectors module. It continuously ingests audit events from multiple audit sources in the Box account, unify the events into a common application events format, enrich the events with needed detection context and send the events to any existing SIEM/SOC system.
How it works
SkyFormation Cloud Connector for Box retrieves the events from the Box service through its APIs. Before sending the events to the existing SIEM/SOC system the connector will
- Unify the events into the SkyFormation unified application events format
- Embed the origin event into the SkyFormation event
- Complement the event with missing information
- Enrich the event with detection context as AD identity information
- Encode the resulted event into a standard format as CEF
- Send the event to the existing SIEM/SOC system over syslog
Box Audit Sources & Events Supported
| Audit Source (API) | Service/Module Covered | Event Types | Events included |
|---|---|---|---|
| Admin Logs | Files & Folders | file/folder synced, file downloaded/uploaded, watermark created/deleted, file/folder viewed/previewed, file/folder deleted/moved/copied/renamed, file locked, file/folder comment addedd/deleted etc | Represents events relate to file and folder management activities |
| Folder ACL | folder permissions changed | Represents events relate to permission changes on folders | |
| Access | login success/failed, login on behalf of, admin login etc, user logged-in from a new device | Represents events relate to access and login activites | |
| Users Management | user created, user deleted, user updated, email lalias confirmed/removed etc | Represents events relate to users management | |
| Groups Management | group created, group deleted, user added to group, user removed from group etc | Represents events relate to groups management | |
| Roles | |||
| Collaboration | collaborator added to folder, collaborator role changed, collaborator invire sent etc | Represents events relate to folder collaboration activities | |
| Sharing | file/folder un/shared, file/folder enabled/disabled for sharing etc | Represents events relate to file/folder sharing | |
| Security Settings | two factor authn enabled by user, user become managed user, app public key added/deleted | Represents events relate to security settings changes in user or system scope | |
| Tasks | task created, task assigned etc | Represents events relate to tasks | |
| Device Management | device association added/removed | Represents events relate to tasks | |
| Folder ACL | folder permissions changed | Represents events relate to permission changes on folders | |
| Suspicious Notifications | file marked malicious (virus found), user session invalidated by Box, collaborator violated upload policy, abnormal download activity | Represents alerts/notification events of malicious activities or indications. Only availble if opt-in | |
| Data Retention | set file auto delete, data retention created/removed, retention policy un/assigned | Represents events relate to storage expiration and data retention | |
| Workflow | content workflow policy added, workflow automation added etc | Represents events relate to worfflows |
How to on-board Box Connector to SkyFormation
Adding Box Connector To SkyFormation Platform
Comments
0 comments
Please sign in to leave a comment.