146 lines
3.9 KiB
JSON
146 lines
3.9 KiB
JSON
{
|
||
"version": 1,
|
||
"defaults": {
|
||
"enabled": true,
|
||
"cooldownSeconds": 300,
|
||
"action": "alert",
|
||
"severity": "medium"
|
||
},
|
||
"nativeControls": {
|
||
"mode": "monitor",
|
||
"rollout": {
|
||
"baselineDays": 7,
|
||
"requireGuardHeartbeat": true,
|
||
"allowGlobalBlock": false
|
||
},
|
||
"channels": {
|
||
"removableStorage": {
|
||
"action": "audit",
|
||
"windows": {
|
||
"mechanisms": ["gpo-device-restrictions", "set-disk-readonly"],
|
||
"target": "write"
|
||
},
|
||
"linux": {
|
||
"mechanisms": ["fanotify", "auditd"],
|
||
"target": "mountpoints"
|
||
},
|
||
"macos": {
|
||
"mechanisms": ["mdm-restrictions", "endpoint-security"],
|
||
"target": "managed-devices"
|
||
},
|
||
"chromeos": {
|
||
"mechanisms": ["data-controls"],
|
||
"target": "removable-storage"
|
||
}
|
||
},
|
||
"print": {
|
||
"action": "audit",
|
||
"windows": {
|
||
"mechanisms": ["printservice-operational-log", "spooler-cancel-job"]
|
||
},
|
||
"linux": {
|
||
"mechanisms": ["cups-logs"],
|
||
"enforcement": "monitor-only"
|
||
},
|
||
"macos": {
|
||
"mechanisms": ["mdm-printing-restrictions"],
|
||
"enforcement": "managed-only"
|
||
},
|
||
"chromeos": {
|
||
"mechanisms": ["data-controls"]
|
||
}
|
||
},
|
||
"clipboard": {
|
||
"action": "audit",
|
||
"windows": {
|
||
"mechanisms": ["clipboard-monitor", "clear-clipboard"],
|
||
"blockScope": "high-confidence-only"
|
||
},
|
||
"linux": {
|
||
"mechanisms": ["desktop-clipboard-monitor"],
|
||
"enforcement": "monitor-only"
|
||
},
|
||
"macos": {
|
||
"mechanisms": ["endpoint-monitor", "mdm-restrictions"],
|
||
"enforcement": "monitor-first"
|
||
},
|
||
"chromeos": {
|
||
"mechanisms": ["data-controls"]
|
||
}
|
||
},
|
||
"browserUpload": {
|
||
"action": "audit",
|
||
"windows": {
|
||
"mechanisms": ["managed-browser-policy", "browser-extension"]
|
||
},
|
||
"linux": {
|
||
"mechanisms": ["managed-browser-policy", "proxy-logs"]
|
||
},
|
||
"macos": {
|
||
"mechanisms": ["managed-browser-policy", "network-extension"]
|
||
},
|
||
"chromeos": {
|
||
"mechanisms": ["data-controls"]
|
||
}
|
||
},
|
||
"appExecution": {
|
||
"action": "audit",
|
||
"windows": {
|
||
"mechanisms": ["applocker", "wdac"]
|
||
},
|
||
"linux": {
|
||
"mechanisms": ["auditd", "fanotify", "bpf-lsm"],
|
||
"enforcement": "fanotify-or-lsm-only"
|
||
},
|
||
"macos": {
|
||
"mechanisms": ["mdm-restrictions", "endpoint-security"]
|
||
},
|
||
"chromeos": {
|
||
"mechanisms": ["admin-console-app-policy"]
|
||
}
|
||
}
|
||
}
|
||
},
|
||
"endpoint": {
|
||
"clipboard": [
|
||
{
|
||
"id": "clipboard-sensitive-keywords",
|
||
"enabled": true,
|
||
"cooldownSeconds": 300,
|
||
"action": "alert",
|
||
"severity": "high",
|
||
"message": "В буфере обнаружены чувствительные ключевые слова",
|
||
"minLength": 20,
|
||
"regexPatterns": [
|
||
"(?i)парол(ь|и)",
|
||
"(?i)password",
|
||
"(?i)secret",
|
||
"(?i)cvv",
|
||
"(?i)паспорт"
|
||
]
|
||
}
|
||
],
|
||
"usb": [
|
||
{
|
||
"id": "usb-media-connected",
|
||
"enabled": true,
|
||
"cooldownSeconds": 300,
|
||
"action": "alert",
|
||
"severity": "medium",
|
||
"message": "Подключен съемный носитель"
|
||
}
|
||
],
|
||
"print": [
|
||
{
|
||
"id": "print-sensitive-docs",
|
||
"enabled": true,
|
||
"cooldownSeconds": 300,
|
||
"action": "alert",
|
||
"severity": "high",
|
||
"message": "Печать документа с признаками чувствительных данных",
|
||
"documentRegex": "(?i)(salary|зарплат|passport|паспорт|договор|contract)"
|
||
}
|
||
]
|
||
}
|
||
}
|