{"id":8557,"date":"2023-09-11T13:22:54","date_gmt":"2023-09-11T12:22:54","guid":{"rendered":"https:\/\/gatlabs.com\/knowledge\/?post_type=docs&p=8557"},"modified":"2023-09-11T15:26:40","modified_gmt":"2023-09-11T14:26:40","password":"","slug":"remove-external-sharing-on-files-with-sensitive-information-via-schedule-report","status":"publish","type":"docs","link":"https:\/\/gatlabs.com\/knowledge\/tech-tips\/remove-external-sharing-on-files-with-sensitive-information-via-schedule-report\/","title":{"rendered":"Remove External Sharing on Files with Sensitive Information via Schedule Report"},"content":{"rendered":"

The GAT+<\/strong><\/a> tool helps every Google Workspace<\/a> Super Admin<\/strong> to have an extensive and detailed view of their entire domain data.<\/p>\n

You can access a granular overview of all files shared within and outside your domain in the Drive audit<\/a> section.<\/p>\n

Almost every feature in GAT+ allows you to set up and generate a Scheduled report<\/strong><\/a>.<\/p>\n

This post outlines the steps to:<\/p>\n

    \n
  1. Apply a filter that returns metadata for files with “sensitive” content shared outside the domain.<\/li>\n
  2. Schedule a report to notify Admins of this specific event.<\/li>\n
  3. Set up external sharing removal to restore the confidentiality of sensitive files.<\/li>\n<\/ol>\n

    Files filtering<\/h2>\n

    To schedule the report that identifies all the external sharing of the files containing sensitive data, navigate to the Drive (1)<\/strong> auditing section of GAT+.<\/p>\n

    Next, under the Drive Files (2)<\/strong> tab apply a filter by clicking on the ‘funnel’ icon (3<\/strong>).<\/p>\n

    The Files filters (4) window is displayed. Type the Name (5)<\/strong> of this File filtering option, and select Type: Full Content Search (6)<\/strong>.<\/p>\n

    Full Content Search<\/strong> allows the Admin to apply a Query (7)<\/strong> and search in the \u201cContent\u201d of the file for the chosen \u201cquery\u201d, e.g. “SSN”.<\/p>\n

    Under Org. (8)<\/strong>, enter the Organizational Unit in which you wish the metadata to be scanned after the filter is applied. To target the entire domain, select the top-level Org. Unit “\/<\/strong>” and select Include Sub. Org.<\/strong> to include all Sub-Organizational Units.<\/p>\n

    Full Content Search<\/strong>\u00a0can be\u00a0combined<\/strong>\u00a0with search options in the Definition <\/strong>section. To target only the external shares, add the rule: Sharing flag > contains > Shared out (9)<\/strong>.<\/p>\n

    When all is set up, the schedule report can be configured by enabling the Scheduled (10)<\/strong> option.<\/p>\n

    \"Remove<\/p>\n

    Scheduling report<\/h2>\n

    Move forward by configuring the scheduled report settings. Select the Export type (1)<\/strong>, and Occurrence (2)<\/strong> time that meet your needs (how often you want to receive the report).<\/p>\n

    Make sure to tick the Enabled (3)<\/strong> option for the scheduled report to be active as soon as the setup is complete.<\/p>\n

    Select the Recipient (4)<\/strong> of this report.<\/p>\n

    Finalize the process by clicking on Apply & Schedule (5)<\/strong>.<\/p>\n

    \"GAT+<\/p>\n

    Job action edition<\/h2>\n

    You can view and edit the scheduled report setup from the Scheduled Report<\/strong> section in GAT+.<\/strong><\/p>\n

    \"GAT+<\/p>\n

    Furthermore, an additional configuration can be made to ensure that the external sharings identified by the filtering GAT+ are removed.<\/p>\n

    This can be set up by clicking on Job Action Edit.<\/strong><\/p>\n

    \"Job<\/p>\n

    A Scheduled job details<\/strong> window appears where the further job can be configured accordingly.<\/p>\n

    Select the External (1)<\/strong> tab and tick the Remove All External Shares (2)<\/strong>.<\/p>\n

    Under the Configuration section, make sure to set the Status to Enabled (3)<\/strong>.<\/p>\n

    Once all is ready, apply for the job by clicking on the Save settings<\/strong> button (4)<\/strong>.<\/p>\n

    \"GAT<\/p>\n

    Results<\/h2>\n

    A scheduled report is configured to identify external file shares with “sensitive” content and notify the administrator of these events.<\/p>\n

    Additionally, depending on the settings enabled, the report will run automatically based on the Occurrence time selected.<\/p>\n

    \"Remove<\/p>\n

    Additionally, GAT+ configures a task to automatically delete these external shares once they are identified, providing protection against data leakage.<\/p>\n

    The filter setup identifies the files from which external shares will be automatically removed.<\/p>\n

    The record of the Drive report being generated (1)<\/strong>, as well as shares removal (2)<\/strong>, will be kept in the Admin Log <\/strong>in GAT+.<\/strong><\/p>\n

    \"GAT+<\/p>\n

    The result will be visible in the GAT+<\/strong> Drive<\/strong> section when a new scan of the Drive<\/strong> metadata is completed.<\/p>\n

    To check, navigate to the Drive section of GAT+ (1)<\/strong>, under the Files tab (2)<\/strong> apply a filter (3)<\/strong> to find a file in question that was reported as shared out (you can use File Title, File ID, or any other metadata available from the report).<\/p>\n

    Subsequently, the file in question is returned by GAT+, and the privacy of the file can be confirmed under the Sharing flag<\/strong> section (4)<\/strong>.<\/p>\n

    This flag confirms that all existing external shares have been removed from the file and made it private again.<\/p>\n

    \"GAT+<\/p>\n

    Related posts<\/h2>\n