Troubleshooting tip: FortiDLP Cloud connector policies

When configuring cloud connector policies, there are several steps that can be taken in order to troubleshoot why something may not be working as expected.

1. Verify that cloud connector events are associated with the correct user.

The first thing to verify is that the events that are coming through are indeed associated with the correct user. To confirm that this is configured correctly, first find the UUID of the user from the Users page in the FortiDLP console:

Then copy this and use it in the API endpoint '/api/v2/users/{uuid}/useruri', to verify the URIs associated with the user. The URIs should include a username URI that matches either the primary email or UPN of the user in Google/Microsoft. If this does not exist, then it can be added either via a cloud sync (found in this document Integrate under 'Microsoft' or 'Google') or manually added using the '/api/v1/admin/users/{id}/useruris' API endpoint.

2. Ensure the policy is correctly scoped to users.

It is important to note that cloud connector policies, as they are associated with a specific user rather than a specific machine, should only be scoped to entities using user labels. If a policy group includes certain entities based on a machine label, then the cloud policies within that group will not be applied to anyone.

3. Verify that audit logging is enabled (Microsoft only).

To configure the Microsoft cloud connector, auditing must be enabled in the Microsoft 365 org. This can be confirmed via the Compliance portal or PowerShell, and full instructions can be found in this document: Enabling the Microsoft SharePoint and OneDrive Connector.

4. Check that the cloud events expected are generated within Microsoft/Google.

If a cloud connector policy is not raising a detection when it is expected to, a worthwhile troubleshooting step is to ensure that the expected triggers (e.g., when a file is shared or deleted) are present in the Microsoft/Google audit log.

1. SharePoint/OneDrive.

1. Navigate to 'https://purview.microsoft.com'.
2. Select 'Audit' from the left-hand menu.
                                                 
   

    

3. Select a start and end date for the search using the 'Date and time range (UTC) Start' and 'Date and time range (UTC) End' fields.
                                                                       
   

    

4. Narrow down the search to the event type using either the 'Activities - friendly name' or 'Activities - operation names' fields. A list of the mappings between the Purview operation names and FortiDLP event names is given at the end of this section.
                                                                        
   

    

5. Select 'Search'.
                                                                     
   

    

6. A job will appear in the table at the bottom of the page.
                                                                      
   

    

7. Wait and select 'Refresh' until the job status progresses to 'Complete'. Depending on the size of the search window and the number of events, this can take up to several minutes.
                                                                          
   

    

8. Select the entry in the table for the completed search to view the result of the search.
                                                                
   

    

Appendix: Purview operation names to FortiDLP event types.

Operation names are given in bold, with the FortiDLP event types underneath.

2. Google Drive.

1. Navigate to 'https://admin.google.com/'.
2. From the menu on the left-hand side, select Reporting -> Audit and investigation -> Drive log events.
                                                                           
   

    

   

    

3. Add filters to limit the search. To limit to specific events, select 'Add a filter', select 'Event' from the dropdown, and then search for the event type and select the matching option. A list of mappings between Google event names and FortiDLP event names is given at the end of this section.
                                                        
   

    

   

    

4. Select 'Search'.
                                                                               
   

    

5. A list of matching results will be displayed in the table at the bottom of the page.
                                                           
   

    

Appendix: Google events to FortiDLP event types.

Google events are given in bold, with the FortiDLP event types underneath.