# DataDefender Introduction DataDefender allows you to monitor access to your data, understand what it contains, and identify exposed storage resources with prioritized alerts that help you stop ransomware, insider misuse, and data exfiltration. {% embed url="" %} ### How to Use this Help Documentation This help guide is broken into three main sections: * [Getting Started](/getting-started/subscribing-to-datadefender) * Get up and running in minutes * [How it Works](/how-it-works/portal-overview) * Product functionality, architecture, configuration, and more * [Release Notes](/release-notes) * Track product updates * [Contact Us](/contact-us-and-support) * We're here to help # Subscribing to DataDefender Subscribe to DataDefender. There are currently two ways to get DataDefender: through the AWS Marketplace, and through our direct registration page. Direct Registration is the go-to path if you plan to transact directly with Cloud Storage Security. Alternatively, if your organization prefers to transact through AWS Marketplace, subscribe through our [Marketplace listing](https://aws.amazon.com/marketplace/pp/prodview-w4jw5kpsq2i24?sr=0-9\&ref_=beagle\&applicationId=AWSMPContessa). ### Direct registration page (Recommended) 1. Navigate to our [Direct Registration Page](https://cloudstoragesecurity.com/datadefendersignup). 2. Fill out the following items on the form: 1. First Name 2. Last Name 3. Company Email 4. Company Name 3. You will receive a startup email to access your account in our Console.

### Subscribing through Marketplace 1. In AWS Marketplace, navigate to 'Discover products' and search for 'DataDefender by Cloud Storage Security'. You should see the following screen:

2. Select 'View purchase options' and select the contract duration, auto-renewal settings, and the purchase tier (1-5). The tier you should select will be determined by organization size, please refer to the table below:

DataDefender Purchase Tier	Company Size
Tier 1	1-200
Tier 2	201-500
Tier 3	501-5,000
Tier 4	5,001-10,000
Tier 5	No Limit

3. Select 'Submit' 4. You will be asked to submit a form on our [Direct Registration](https://signup.datadefender.io/) page. Enter in your company name and business email, and you will receive a startup email to access your account in our Console. ## Getting Started After you have your login information, go ahead and proceed to the [Get Started](/getting-started/linking-aws-to-datadefender) page to begin ingesting data. # Linking AWS to DataDefender Welcome to the DataDefender portal! Assuming you are already logged in to the DataDefender solution, all you need to get started is to link AWS accounts for us to ingest. If you have not yet subscribed to DataDefender, please do so by following the instructions at [Subscribing to DataDefender](/getting-started/subscribing-to-datadefender).

## Linking AWS Accounts To get started, you will deploy our CloudFormation stack into the first AWS account which you would like to us to ingest data from, confirm the stack creation in DataDefender, and we'll begin ingesting data. You can link as many AWS accounts as you would like using the following method. Linking an Account is a 4-5 step process. This page will detail how to complete each step. * Initiate Deployment from DataDefender * Configure and deploy CloudFormation stack from AWS * Add SQS Permissions and set up Event Notification (If using Activity Monitor) * Link the stack to DataDefender * Confirm Deployment ### 1. Initiate Deployment from DataDefender In order to do this, navigate to Settings > **Linked Accounts** and click the "Link New Account" button. The following form will assist in linking an AWS Account. #### Account Details

* Enter the Account ID of your AWS account. 1. To find your account id, sign in to the AWS Management Console, click your account name in the top-right corner. Your 12-digit Account ID will display within this dropdown. * Optionally, add an Account Name. 1. We recommend you add the friendly name of your account, but this can be whatever you would like that will help you identify this account later. 2. This name can be changed at any time if you’d like. #### Inventory Selection

* Select the AWS Services that you would like us to collect and protect. 1. Selecting a service will ensure the required permissions are deployed by the CloudFormation stack for us to retrieve its data. These permissions can be modified at any time. 2. Selecting 'Security Checks' allows us to run configuration checks against your account to identify misconfigurations and compare your account against data security best practices. #### File Scanning

* File Scanning allows DataDefender to scan and classify your data to find sensitive files. DataDefender will be granted ECS deployment permissions into select regions. Data scanned will never leave the region where it resides in. #### Activity Monitoring

* Activity Monitoring allows DataDefender to ingest CloudTrail and/or S3 Server Access Logs. For each type of activity monitor (CloudTrail, S3 Server Access Logs) we require one S3 bucket already set up with logs directed into them for the Application to ingest logs. DataDefender uses this information in its [Monitoring](broken://pages/sDPQ1rUfPNAlzMF0D2jc) and [File Access Report](broken://pages/9Lb4diPpJWfoYW4DOaIY) features. Please refer to the [Configuring CloudTrail Log Bucket](#configuring-cloudtrail-log-bucket) and [Configuring Server Access Log Bucket](#configuring-server-access-log-bucket) sections for more details. * Copy the full S3 bucket ARN for your desired log repository buckets and paste into the appropriate field. ### 2. Configure and deploy CloudFormation stack in AWS Select 'Launch CloudFormation'. It will bring you to an AWS Login where you will need to sign in to the account where you wish to deploy our stack. Once signed in, you'll be brought to CloudFormation's 'Quick create stack' menu.

Linked Account Stack Parameters Currently, we have 13 parameters that you can configure to deploy our stack. Most settings are already created from the form from the previous step. Here is each parameter and its function:

Parameter	Function	Example Values
Stack Name	What your stack will be named	my-stack
ActivityMonitoringCloudTrailQueueName	Optional; name to give the created Activity Monitoring SQS queue.	datadefender-activity-monitoring-ct
ActivityMonitoringCloudTrailS3BucketArn	The ARN of the S3 bucket that CloudTrail events are logged to.	arn:aws:s3:::example
ActivityMonitoringS3ServerAccessLogsBucketArn	The ARN of the S3 bucket that S3 server access logs are logged to.	arn:aws:s3:::example
ActivityMonitoringS3ServerAccessLogsQueueName	Optional; name to give the created Activity Monitoring S3 Server Access Logs SQS queue.	datadefender-activity-monitoring-sal
ConnectionManagementType	Whether the connection is self-managed or is a manager of other connections.	Self, Managed
EnableActivityMonitoringCloudTrailFeatureSet	Pick Yes if you would like to enable the activity monitoring feature set for a CloudTrail event source.	Yes, No
EnableActivityMonitoringS3ServerAccessLogsFeatureSet	Pick Yes if you would like to enable the activity monitoring feature set for a S3 Server Access Logs event source.	Yes, No
EnableEBSInventoryFeatureSet	Pick Yes if you would like to enable the EBS Inventory feature set.	Yes, No
EnableFileSystemsInventoryFeatureSet	Pick Yes if you would like to enable the File Systems Inventory feature set.	Yes, No
EnableS3InventoryFeatureSet	Pick Yes if you would like to enable the S3 Inventory feature set.	Yes, No
EnableSecurityChecksFeatureSet	Pick Yes if you would like to enable the security checks feature set.	Yes, No
IamRoleNameSuffix	Optional; suffix to include in the created IAM role. May be required if there are IAM role name conflicts.	CloudStorageSec
IdentityProviderUrl	The URL of the Cloud Storage Security identity provider to verify the identity when assuming the role. Do not include https:// in the URL. This does not have to be modified.	auth.datadefender.io/realms/datadefender

After you are satisfied with your parameters, select '**I acknowledge that AWS CloudFormation might create IAM resources with custom names.**' and deploy the stack. ### 3. Set up Event Notification {% hint style="info" %} This section only applies if you are using the Server Access Logs or CloudTrail functionality. {% endhint %} #### Event Notification For each type of bucket you've set up (Server Access Logs bucket, CloudTrail bucket): Go to the S3 Bucket that the SQS Queue corresponds to and navigate to Properties. Under 'Event Notifications', click 'Create Event Notification'.

In the settings: 1. Set an Event name of your choosing. 2. Ensure that 'All object create events' are checked. 3. Set destination as SQS queue, and specify the corresponding SQS queue that was created. 4. Select 'Save changes'. ### 4. Link the Stack to DataDefender Go to the deployed CloudFormation stack and open the **Outputs** tab. You should see three outputs if you are using both the Activity Monitoring and Server Access Logs features. Otherwise, you'll just see one output. * For all deployments, copy the **ARN of the Cross-Account IAM Role**. * If you also enabled **Activity Monitoring – S3 Server Access Logs** and **Activity Monitoring – CloudTrail Feature Set**, copy the values of the respective queues as well.

Now, return to the **DataDefender portal** and complete the following steps: 1. Leave the CloudFormation stack name and region as they appear (these are the stack name and region used in the previous deployment). 2. Paste the **Cross-Account IAM Role ARN** into the **AWS Role ARN** field.

If you enabled Activity Monitoring with CloudTrail or S3 Access Logging, complete **Configure Activity Monitoring**. (Otherwise, disable both CloudTrail and S3 Server Access Logs checkboxes and skip this step.) * Paste the **CloudTrail Queue** value from the Outputs into the *CloudTrail queue name* field, and select the region where the queue resides. * Paste the **S3 Access Logging Queue** value from the Outputs into the *S3 queue name* field, and select the region where the queue resides.

Click 'Complete Setup' to finalize your account linkage. ### 5. Confirm Deployment Your stack should now be linked. Verify in the 'Linked Accounts' section for the green check symbol under 'Credential Status' alongside your alias.

## Using the Product Now that you have data flowing into your account, you are free to start using DataDefender! For explanations of the DataDefender Portal, head on over to the [Portal Overview](/how-it-works/portal-overview) page. # Linking Google Workspace Connecting your Google Drive environment to DataDefender enables automated inventorying, sensitive data discovery, and continuous classification across your organization’s files. To ensure least privilege and maintain a keyless, zero-trust architecture, the onboarding process is split into two distinct steps: 1. Infrastructure & Workspace Setup: Deploying the required identity infrastructure in Google Cloud (GCP) and granting delegated API permissions in Google Workspace. 2. Platform Connection: Inputting your environment details into the DataDefender web application to establish and verify the active connection. #### Integration Steps Choose a step below to get started, or share these links directly with the team members responsible for each environment: **Step 1: Configure GCP & Google Workspace**\ Primary Audience: GCP Project Admins / DevOps & Google Workspace Super Admins Where It Happens: Terminal (`gcloud` / Terraform) & Google Workspace Admin Console (`admin.google.com`) Deploy the underlying GCP identity infrastructure and configure Google Workspace permissions. This step: * Provisions a keyless Workload Identity Pool and dedicated Service Accounts via Terraform. * Authorizes Domain-Wide Delegation for required Drive and Directory scopes. * Sets up isolated Impersonation Admin and Crawler user accounts. 👉 Go to Step 1: [GCP & Google Workspace Setup Guide](/getting-started/linking-google-workspace/connecting-google-workspace-to-datadefender) **Step 2: Connect Google Drive in DataDefender**\ Primary Audience: DataDefender Administrators Where It Happens: DataDefender Web Application (Settings -> Cloud Connectivity) Finalize your tenant connection within the DataDefender platform. This step: * Maps your Google Workspace Customer ID and service account credentials. * Links your environment to an active AWS scanning account and region. * Executes an automated handshake to verify keyless authentication and permissions. 👉 Go to Step 2: [DataDefender Connection Guide](/getting-started/linking-google-workspace/linking-google-drive-to-datadefender) *** #### Frequently Asked Questions Why does this setup require both GCP and Google Workspace? > DataDefender uses Google Cloud's Workload Identity Federation (WIF) to authenticate keylessly without static secrets or long-lived passwords. The GCP project acts as the secure identity bridge, while Google Workspace holds the actual Drive data and Domain-Wide Delegation permissions. Can one person complete both steps? > Yes. If an individual has administrative access to your GCP project, Google Workspace Admin Console, and DataDefender, they can complete both steps sequentially in about 15 minutes. What permissions does DataDefender require in our environment? > DataDefender adheres to strict least-privilege principles. Access is limited strictly to Google Drive and Directory read/inventory scopes granted via Domain-Wide Delegation and constrained to a custom administrator role. # Connecting Google Workspace to DataDefender Connect your Google Workspace environment to DataDefender to enable automated Google Drive inventorying and data classification. ### Who Needs to Be Involved? Setup requires administrative access in both Google Cloud (GCP) and Google Workspace.\ Depending on your team structure, one person can perform all steps, or a Cloud Engineer can complete Steps 1–2 while a Workspace Super Admin completes Steps 3–5.
| Role | Steps | Tools & Access Required | | --------------------- | ----------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | GCP Project Admin | Steps 1 & 2 |

• Target GCP Project

• gcloud CLI & Terraform 1.5+

• DataDefender Terraform package (downloaded from app)

• AWS Account ID

• DataDefender Organization ID

| | Workspace Super Admin | Steps 3–5 | • Access to Google Workspace Admin Console (admin.google.com) | ### Setup Instructions **Step 1: Authenticate to Your GCP Project** Open your terminal, authenticate the gcloud CLI, and set your target Google Cloud project: ```bash gcloud auth application-default login gcloud config set project YOUR_PROJECT_ID gcloud auth application-default set-quota-project YOUR_PROJECT_ID ``` **Step 2: Apply the Infrastructure via Terraform**

Download the DataDefender Terraform ZIP file from the Connect Google Drive page. This is accessed through Settings -> Cloud Connectivity -> Add New Connection -> Google Drive.\ \ Once you have the ZIP file downloaded, navigate to its directory in your terminal, and run: ```bash terraform init terraform apply \ -var "project_id=YOUR_PROJECT_ID" \ -var "scanning_aws_account_id=YOUR_AWS_ACCOUNT_ID" \ -var "organization_id=YOUR_DATADEFENDER_ORGANIZATION_ID" ``` Optional: If you customized your AWS Agent Role Name during onboarding, append `-var "agent_aws_role_name=YOUR_ROLE_NAME"` to the command above (default is `CloudStorageSecAgentRole`). Review the plan, type `yes` when prompted, and then retrieve the values required for the next step: ```bash terraform output dwd_authorization_table ``` Note on Terraform State: By default, local execution stores state files locally in your working directory. We strongly recommend persisting state using a[ remote backend](https://developer.hashicorp.com/terraform/language/state/remote) configured with a[ backend block](https://developer.hashicorp.com/terraform/language/backend) (such as Google Cloud Storage) to manage state securely across your team. **Step 3: Authorize Domain-Wide Delegation** Because Google requires explicit administrative approval for high-privilege API scopes, a Workspace Super Admin must grant delegation manually in the Admin Console. 1. Log in to[ admin.google.com](https://admin.google.com). 2. Navigate to Security -> Access and data control -> API controls. 3. Under Domain-wide delegation, click Manage Domain Wide Delegation. 4. Click Add new for each of the two entries in your `terraform output` table and enter the corresponding Client ID and OAuth Scopes: | Service Account | Required OAuth Scopes | | --------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Backend | | | Agent | | 1. Click Authorize and verify both entries appear in your list with active status. **Step 4: Create the Impersonation Admin User** DataDefender uses this identity as its "impersonation subject." When our backend inventories your environment, lists users, or manages Shared Drive access rules, it acts as this specific identity under the Domain-Wide Delegation scopes authorized in Step 3. We strongly recommend creating a dedicated service user (e.g., `datadefender-admin@yourdomain.com`) rather than linking an existing person’s admin account. How to Set Up: 1. In the Admin Console, go to Directory -> Users -> Add new user (e.g., `datadefender-admin@yourdomain.com`). 2. Go to Account -> Admin roles -> Create new role. 3. Name the role DataDefender Administrator and check only the Drive and Docs Administrator privilege. 4. Assign this custom role to `datadefender-admin@yourdomain.com`. 5. Record the full email address to submit during onboarding. Why a Dedicated Account is Recommended: * Clear Audit Trail: Every API management action performed by DataDefender is isolated to this single identity in your Workspace audit logs. * Least Privilege: Existing admin accounts are usually over-privileged. A dedicated account constrains DataDefender strictly to Drive and Docs Administrator rights. * Continuity & Revocation: Access remains unaffected by staff changes, and can be suspended in a single click without impacting real users. **Step 5: Create the Crawler User** This account is distinct from the Impersonation Admin in Step 4. While Step 4 handles administrative discovery and setup, the Crawler User is a standard account used during automated scanning runs to safely inspect file contents. When DataDefender scans a Shared Drive, our backend dynamically grants this Crawler account Reader access to the drive. How to Set Up: 1. In the Admin Console, go to Directory -> Users -> Add new user (e.g., `datadefender-crawler@yourdomain.com`). 2. Do not grant this account any admin roles or administrative privileges. 3. Record the full email address to submit during onboarding. Why Two Separate Accounts? * Separation of Duties: Administrative operations (listing users, mapping drives) are isolated from content reading. * Security & Minimal Access: The Crawler User operates as a basic Workspace user with zero admin rights. It only sees content in Shared Drives where it has been explicitly assigned read access during an active scan. ### Onboarding Completion Checklist Verify the following before submitting details to DataDefender: * `terraform plan` returns No changes (confirming idempotent configuration). * Both Client IDs are authorized under Domain-Wide Delegation in the Workspace Admin Console. * Dedicated Impersonation Admin user exists with the Drive and Docs Administrator role. * Dedicated Crawler User exists as a standard user account. Final Step: Provide the email addresses for the Impersonation Admin (`datadefender-admin@...`) and Crawler User (`datadefender-crawler@...`) to your DataDefender account manager. These values will be required to complete the Google Drive connection within Settings -> Cloud Connectivity. ### Disconnecting & Teardown To completely remove DataDefender's access from your environment: 1. Destroy GCP Infrastructure: Open your terminal in the Terraform directory and run: ```bash terraform destroy ``` 2. (Note: This removes service accounts and WIF bindings, but leaves GCP APIs enabled so other workloads in your project are not impacted).\ Remove Domain-Wide Delegation: In the Workspace Admin Console (Security -> Access and data control -> API Controls -> Domain Wide Delegation), delete both authorization entries. 3. Remove User Accounts: Delete or suspend the `datadefender-admin` and `datadefender-crawler` user accounts. 4. If you want to fully unlink this Google Drive workspace from DataDefender, you will also want to login to the DataDefender application, navigate to Settings > Cloud Connectivity, and remove the provider connection. ### Appendix: Security Architecture Architecture & Security Overview * Keyless Authentication (Federation): No service account keys, secrets, or long-lived passwords are ever generated or stored. Authentication occurs dynamically over short-lived Google tokens using Workload Identity Federation (WIF). * Explicit Grants: Federation only verifies identity—it does not grant access to data. Access is strictly constrained through Domain-Wide Delegation (scoped to specific, minimal OAuth permissions) and the dedicated impersonation identity. * Instant Revocation: You retain 100% control over your data. You can completely revoke DataDefender’s access at any time by removing the delegation entries or suspending the service user accounts in Google Workspace. # Linking Google Drive to DataDefender Use this guide to complete the Google Drive connection setup inside your DataDefender organization. Connecting your Google Drive environment allows DataDefender to safely inventory, analyze, and classify your organization’s drives and shared drives. ### Before You Begin (Prerequisites) Connecting Google Drive requires setup across three environments: GCP, Google Workspace, and DataDefender. If your team hasn't completed the backend infrastructure deployment yet, start with Step 1 below. If your Cloud and Workspace admins have already deployed the Terraform module and authorized delegation, skip directly to Step 2. ### Step 1: Complete Prerequisites Before filling out the form in DataDefender, ensure your team has completed the following: 1. AWS Account Connected: Your target scanning AWS Account must already be linked in DataDefender (Settings -> Cloud Connectivity). That account must have the `File Scanning` feature set enabled. 2. GCP & Workspace Deployed: Your GCP Administrator and Workspace Super Admin must deploy the DataDefender Terraform module and authorize Domain-Wide Delegation in the Workspace Admin Console. Need the infrastructure setup steps? Send your technical team our [GCP & Google Workspace Integration Guide](/getting-started/linking-google-workspace/connecting-google-workspace-to-datadefender). ### Step 2: Gather Required Values Once Step 1 is complete, make sure you have the following details ready before filling out the connection form: * Workspace Details: * Google Workspace Customer ID * Impersonation Admin Email * Crawler User Email. * Terraform Outputs: The four specific values generated from your GCP deployment: * Backend\_sa\_email * Agent\_sa\_email * Backend\_wif\_audience * agent\_wif\_audience ### Connection Instructions When you have gathered your prerequisite values, follow these steps to configure your connection in DataDefender: Step 1: Navigate to Cloud Connectivity 1. Log in to DataDefender. 2. In the left navigation menu, go to Settings -> Cloud Connectivity. 3. Click Add New Connection. 4. Select Google Drive from the provider options to open the Connect Google Drive page. Step 2: Configure Connection Fields Populate the form fields using your Google Workspace details and the values generated from your Terraform output. 1\. Account Details * Google Workspace Customer ID: Your unique Google Workspace organization ID. (If you need help finding this, refer to[ Google's Customer ID Guide](https://knowledge.workspace.google.com/admin/getting-started/find-your-customer-id)). * Account Name: Enter a friendly display name for this connection (e.g., Corporate Google Drive). 2\. Google Workspace Settings * Customer GCP Project ID: The Google Cloud Project ID where your team deployed the DataDefender Terraform module. * Admin Impersonation Email: The email address of the dedicated Workspace user created for administrative discovery (e.g., ). * Crawler User Email: The email address of the dedicated standard Workspace user created for content scanning (e.g., ). 3\. Terraform Outputs Enter these exact values from [your terminal output](/getting-started/linking-google-workspace/connecting-google-workspace-to-datadefender#setup-instructions) (terraform output `dwd_authorization_table`): * Backend Service Account Email: Value corresponding to `backend_sa_email.` * Agent Service Account Email: Value corresponding to `agent_sa_email.` * Backend WIF Audience: Value corresponding to `backend_wif_audience`. * AWS Agent WIF Audience: Value corresponding to `agent_wif_audience`. 4\. Scanning Target * Scanning AWS Account: Select the linked AWS Account where DataDefender’s scanner agent tasks will be hosted. * Scanning Region: Select the specific AWS region where your scanner agent tasks will deployed. Step 3: Save & Verify Connection 1. Review all entered fields for accuracy. 2. Click Connect & Verify. DataDefender will perform an immediate automated handshake check to confirm that Workload Identity Federation (WIF) is active and that the service accounts have access to your Google Workspace environment. ### Troubleshooting & Common Issues | Issue | Likely Cause | Resolution | | ---------------------------- | ------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------- | | Authentication Failed | Incorrect WIF Audience or SA Email | Verify the exact strings from your terraform output command and ensure no leading or trailing spaces were pasted into the form. | | Domain-Wide Delegation Error | Missing OAuth Scopes in Workspace | Refer back to the GCP & Google Workspace Integration Guide and confirm both Client IDs and scopes are active in admin.google.com. | | Access Denied Error | Impersonation or Crawler user missing | Ensure datadefender-admin and datadefender-crawler accounts exist and are active in your Google Workspace directory. | # Linking Azure Subscriptions Use this guide to connect your Microsoft Azure subscriptions to DataDefender. Connecting Azure allows DataDefender to safely inventory storage accounts, run continuous security posture checks, and deploy scanning agents to classify sensitive data in Azure Blob Storage. #### Before You Begin (Prerequisites) Connecting Azure requires administrative access to your Microsoft tenant. Before starting setup inside DataDefender, ensure you have: * **Azure Permissions:** A Microsoft Entra ID (formerly Azure AD) account with permissions to grant consent, alongside `Owner` or `User Access Administrator` roles on every subscription you intend to link. * **Terraform CLI:** Terraform (`v1.3.0` or higher) installed and configured on your local machine or deployment runner. * **Azure CLI:** Azure CLI (`az`) installed and authenticated to your target tenant via `az login`. #### Connection Instructions

**Step 1: Navigate to Cloud Connectivity** * Log in to DataDefender. * In the left navigation menu, go to **Settings -> Cloud Connectivity**. * Click **Add New Connection**. * Select **Azure** from the provider options to open the Azure onboarding wizard. **Step 2: Authenticate and Discover Subscriptions**

* Click **Sign in with Microsoft**. * Complete the OAuth prompt using your Azure administrator credentials. * Once authenticated, DataDefender automatically retrieves the full list of subscriptions associated with your tenant. **Step 3: Select Target Subscriptions** From the discovered subscriptions list, select the checkbox next to each subscription you want DataDefender to monitor. {% hint style="info" %} You do not need to link your entire cloud footprint at once. You can add more subscriptions later by repeating this workflow. {% endhint %} **Step 4: Configure Capabilities and Resource Location** Configure the features DataDefender will run in each selected subscription: **Inventory & Security** * **Blob Storage Inventory:** Automatically catalogs all storage accounts, containers, and metadata across the subscription. * **Security Checks:** Analyzes storage configurations against DataDefender security benchmarks to identify misconfigurations, public exposures, and compliance gaps. **File Scanning** * **Blob Storage Classification:** Provisions agent infrastructure within the Azure subscriptions to inspect and classify files residing inside Blob Storage. * **OneDrive / SharePoint Scanning:** Hosts the agent workers required to scan your Microsoft 365 environments. {% hint style="warning" %} OneDrive and SharePoint connections require a separate tenant-level link. If you plan to scan M365 data, enable this toggle so DataDefender can run scanner agents inside your Azure perimeter. See our OneDrive & SharePoint Integration Guide to finish M365 configuration. {% endhint %} **Resource Location** * Select your preferred **Azure Region** (e.g., `East US`) from the dropdown. DataDefender will deploy its dedicated scanning resource group into this region. **Step 5: Deploy the Terraform Module**

After selecting your configuration, DataDefender generates a customized Terraform command containing your tenant details, selected flags, and resource group definitions. **1. Download the Module** Click **Download Terraform Package** and unpack the files into your local working directory. **2. Initialize Terraform** Open your terminal, navigate to the extracted directory, and run: ```bash terraform init ``` **3. Execute the Deployment** Copy the pre-populated apply command directly from the DataDefender UI and run it in your terminal. **4. Confirm Execution** Review the planned actions in the console output and type `yes` to confirm. **Step 6: Complete Verification** **1. Copy the Client ID** When the run finishes, copy the `application_client_id` string printed in your terminal output: ``` Outputs: application_client_id = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" ``` **2. Submit and Verify** * Return to the DataDefender portal. * Paste the value into the **Application (Client) ID** field. * Click **Link & Verify**. DataDefender will perform an automated handshake via Federated Identity Credentials (FIC) to confirm API access and validate the deployment. #### Troubleshooting & Common Issues | Issue | Likely Cause | Resolution | | --------------------------------- | -------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Authentication Failed (FIC Error) | Mismatched Subject or Issuer URL | Verify that the fic\_subject and fic\_issuer flags in your terraform apply command match the exact strings provided in the UI without extra trailing slashes. | | Insufficient Privileges | Missing RBAC permissions | Ensure your Azure user account holds the Owner or User Access Administrator role on all target subscriptions to assign service principal roles. | | Subscription Not Listed | Multi-tenant session or scope mismatch | Confirm your CLI is pointing to the correct tenant by running az account show. Re-authenticate using az login --tenant \ if necessary. | | Region Deployment Error | Azure resource quota restriction | Ensure your selected Azure region has available quota for Container Instances and standard networking components. | # Linking OneDrive and Sharepoint Use this guide to connect your Microsoft OneDrive and SharePoint environments to DataDefender. Connecting Microsoft 365 allows DataDefender to safely inventory personal and shared drives, run continuous security posture checks, and classify sensitive content across your organization. {% hint style="warning" %} **Azure Scanning Dependency**\ To scan and classify file content inside OneDrive and SharePoint, you must also connect an Azure Subscription within the same tenant that has **OneDrive/SharePoint Scanning** enabled. That Azure connection provisions the private compute environment that reads and classifies the data. Go here for more details: [Linking Azure Subscriptions](/getting-started/linking-azure-subscriptions) {% endhint %} #### Before You Begin (Prerequisites) Connecting OneDrive and SharePoint requires administrative access across your Microsoft 365 tenant and a local deployment environment. Before starting the setup inside DataDefender, ensure you have: * **Tenant Administrative Access:** A Microsoft Entra ID (formerly Azure AD) account with `Global Administrator` or `Privileged Role Administrator` privileges to grant tenant-wide admin consent for Graph API permissions. * **Terraform CLI:** Terraform (`v1.3.0` or higher) installed and configured on your local machine or CI/CD runner. * **Azure CLI:** Azure CLI (`az`) installed and authenticated to your target tenant via `az login --tenant `. * **Microsoft Entra Tenant ID:** Your unique directory identifier. If you need help finding this, refer to [Microsoft's Tenant ID Guide](https://learn.microsoft.com/en-us/entra/fundamentals/how-to-find-tenant). #### Connection Instructions **Step 1: Navigate to Cloud Connectivity**

* Log in to DataDefender. * In the left navigation menu, go to **Settings -> Cloud Connectivity**. * Click **Add New Connection**. * Select **OneDrive / SharePoint** from the provider options to open the connection wizard. **Step 2: Download the Terraform Module**

* In the setup wizard, click **Download Terraform Package** to download the dedicated M365 deployment files. * Unpack the downloaded `.zip` file into your local working directory. **Step 3: Deploy the Terraform Module** Deploy the module to register the required enterprise application and configure Federated Identity Credentials (FIC) in your Entra tenant. **1. Authenticate to Azure CLI** Open your terminal and ensure your CLI session targets the correct Microsoft 365 tenant: ```bash az login --tenant YOUR_ENTRA_TENANT_ID ``` **2. Initialize Terraform** Navigate to your unzipped directory and initialize the provider plugins: ```bash terraform init ``` **3. Execute the Deployment** Copy the pre-populated `apply` command directly from the DataDefender setup page and execute it: ```bash terraform apply -var 'entra_tenant_id=YOUR_ENTRA_TENANT_ID' -var 'organization_id=ORGANIZATION_ID' -var 'fic_subject=datadefender.orgEntra.ORGANIZATION_ID' -var 'fic_issuer=[https://auth.datadefender.io/realms/datadefender](https://auth.datadefender.io/realms/datadefender)' ``` **4. Confirm Execution** Review the proposed resources in your terminal and type `yes` to perform the deployment and consent registration. **Step 4: Configure Connection Details** Once Terraform finishes applying, populate the setup form fields in the DataDefender console using your deployment outputs: * **Account Name (Optional):** Enter a friendly display label for this environment (e.g., `Corporate M365 Production`). * **Tenant ID:** Enter your Microsoft Entra Tenant ID. * **Backend Application Client ID:** Enter the `backend_app_client_id` string printed in your terminal output: ``` Outputs: backend_app_client_id = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" ``` **Step 5: Connect and Verify** * Review your entered values for accuracy. * Click **Connect & Verify**. DataDefender will perform an immediate automated handshake via Federated Identity Credentials (FIC) to confirm API connectivity and verify Microsoft Graph permissions across your OneDrive and SharePoint drives. #### Troubleshooting & Common Issues | Issue | Likely Cause | Resolution | | --------------------------------- | -------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Admin Consent Missing | Non-admin deployment session | Ensure the user running the Terraform script or approving the app registration holds Global Administrator permissions to grant Microsoft Graph application scopes. | | Authentication Failed (FIC Error) | Mismatched Subject or Issuer URL | Confirm that the fic\_subject and fic\_issuer values used in your terraform apply command match the exact strings shown in your DataDefender portal without trailing spaces. | | Content Scanning Inactive | Missing Azure scanning compute | Verify that you have linked at least one Azure subscription within the same tenant with the OneDrive / SharePoint Scanning toggle enabled. | | Tenant ID Not Found | Multi-directory account mismatch | Confirm your CLI is pointed to the directory containing your OneDrive/SharePoint instances by running az account show and inspecting the tenantId value. | # Portal Overview In the Quick Start section, we covered linking AWS Accounts into DataDefender so that it can begin processing data from your account. Now, let's take a look at the rest of the portal. The following sections will walk you through each area of the Portal and what you can expect from it. Navigation sits on the left side and allows you to access different areas of the Portal. The top right corner of the screen allows you to see the user you're signed in as. It also provides a Help Modal, an Organization Selector, and User settings.

# Data Security Insights The Data Security Insights page is your main dashboard — a central hub that gives you a high-level view of your cloud security posture and quick access to every major feature.

*** ### Overview When you first log in, this page presents six cards, each representing a key security question. Each card is clickable and takes you directly to the relevant feature. | Card | Question It Answers | Destination | | ------------------- | --------------------------------------------------------------------- | ------------------------ | | Data Stores | Where is all my data stored? What types of storage do I use? | Inventory of Data Stores | | Data Classification | What types of data do I have? Do I know where all my data stores are? | Data Classification | | Public Resources | What resources are open to the public? | Public Resources | | Suspected Attacks | Are any attackers trying to get to my data? | Suspected Attacks | | Security Holes | What misconfigurations & security holes exist? | Security Checks | *** ### How to Use This Page Click any card to navigate directly to that feature. **Recommended workflow:** 1. Start with **Data Stores** to confirm all your cloud resources are being monitored. 2. Check **Public Resources** to identify any storage open to the internet. 3. Review **Data Classification** to see where sensitive data has been detected. 4. Check **Security Holes** for misconfigurations that need remediation. 5. Monitor **Suspected Attacks** for any active threat activity. # Data Stores View and Classify Resources. The Inventory of Data Stores page provides a complete catalog of all cloud storage infrastructure discovered across your connected AWS accounts. It shows encryption status, public access exposure, data classification results, and risk levels for every resource. Currently, S3 buckets can be selected for classification.

### Summary Metrics At the top of the page, we have metric cards for an at-a-glance view of data store health.

| Card | What It Shows | | ------------------- | ------------------------------------------------------------------ | | Total Assets | Count of total assets, as well as what's displayed upon the page | | Publicly Accessible | Count of resources broken down by public, private, and unsupported | | Encryption Status | Count of encrypted vs unencrypted resources | | Data Classification | Count of resources with and without classification matches | | Capacity | Resources grouped by size (Large / Medium / Small / Tiny / Empty) |

### Searching and Filtering #### Search Bar Type in the search bar to filter assets by name or property. You can also press `/` on your keyboard to focus the search bar quickly. #### Quick Filters Two pre-built quick filters are available above the asset list: * **Public-facing resources** — Shows only assets accessible from the internet * **Unencrypted storage** — Shows only assets without encryption enabled Click either button to apply it. Click again to remove it. #### Advanced Filters Click the filter icon to expand additional filter options: | Filter | Options | | ----------------- | --------------------------------- | | Size | Large, Medium, Small, Tiny, Empty | | Last Accessed | Time-based ranges | | Risk Level | Critical, High, Medium, Low | | Encryption Status | Encrypted, Unencrypted | | Public Access | Public, Private | #### Active Filter Badges When filters are applied, they appear as badges below the search bar. Click the **×** on any badge to remove that individual filter.

*** ### Asset List Each asset appears as a card showing applicable details: * Resource name and type * AWS region and account * Risk classification level * Encryption status * Last access timestamp * Data classification match status Click an asset card to expand it and see full details.

*** ### Triggering Classification You can manually trigger a data classification scan on one or more applicable assets: 1. Select assets using the checkboxes on each card. 2. Click the **Classify Now** button that appears in the toolbar. 3. Confirm the action in the dialog.

*** ### Pagination Use the **Previous** and **Next** buttons at the bottom of the list to navigate between pages. Use the page size selector to control how many assets appear per page. # Public Resources Lists cloud storage exposed to the internet. The Public Resources page shows all cloud storage assets that are currently accessible by anyone on the internet. Use this page to review, approve, or flag each publicly exposed resource based on whether the exposure is intentional and acceptable.

### Summary Cards Two cards at the top provide a quick count of your exposure status. Resources can be filtered by type. We currently keep track of EBS Snapshots, RDS Databases, RDS Snapshots, and S3 Buckets. ### Status Tabs Resources are organized into three tabs based on their review status: | Tab | Meaning | | ---------------- | ----------------------------------------------------------------- | | **Needs Review** | Newly discovered public resources that have not been assessed yet | | **Approved** | Resources confirmed as intentionally public | | **In Violation** | Resources confirmed as exposed contrary to policy | Click each tab to view resources in that state.

*** ### Reviewing Resources #### Approving a Resource If a public resource is intentional (e.g. a public website assets bucket): 1. Go to the **Needs Review** tab. 2. Check the box next to the resource(s) you want to approve. 3. Select 'Change Status' 4. Click **Approved** and **Save**.

#### Flagging a Violation If a public resource should not be exposed: 1. Go to the **Needs Review** tab. 2. Check the box next to the resource(s) you want to approve. 3. Select 'Change Status' 4. Click **In Violation** and **Save**.

#### Changing a Previously Set Status You can change the status of a resource at any time: * From the **Approved** tab: use **Move to Needs Review** or **Flag as Violation** * From the **In Violation** tab: use **Move to Needs Review** or **Approve Selected** *** ### Resource Cards Each resource card shows: * Resource name and type * Resource cloud account and regional details * An external link that leads to the resource for manual evaluation * Current acknowledgment status

# Data Classification Manage and scan for sensitive data. The Data Classification page shows which of your cloud storage resources contain sensitive data, based on the classification profiles and data patterns configured in your settings. It helps you understand where personally identifiable information (PII), financial data, health records, or other sensitive content is stored.

### How Classification Works DataDefender scans the contents of your storage resources using classification profiles. Each profile contains one or more data patterns (such as a regex for credit card numbers or social security numbers). When a match is found in a resource, that resource appears on this page with the matching profile and pattern shown. *** ### Profile and Pattern Badges At the top of the page, two rows of badges show all detected classification profiles and data patterns across your environment. **Classification Profile badges** — Each badge represents a classification profile that has matched at least one file in your environment. Click a profile badge to filter the asset list to only resources matching that profile. **Data Pattern badges** — Each badge represents an individual data pattern (e.g. "Credit Card Number", "SSN", "IBAN"). Hover over a profile badge to highlight the data patterns it contains. Click a pattern badge to filter by that pattern. *** ### Asset List The asset list shows all storage resources that have at least one classification match. Each item displays: * Resource name and type * Which classification profiles matched * Which specific data patterns matched * AWS region and account Click any asset to expand it and see the full list of matched profiles and patterns. *** ### Filtering #### Filter by Profile or Pattern Click any badge in the profile or pattern rows to filter the asset list to only resources with that match. #### Search Use the search bar to find a specific resource by name. Press `/` on your keyboard to quickly focus the search field. #### Pagination Use the **Previous** / **Next** buttons and the page size selector to navigate through the results. *** ### Triggering a Classification Scan If you want to re-scan specific resources or scan resources that haven't been classified yet, go to Inventory of Data Stores and use the **Trigger Classification** action from there. # Suspected Attacks AI detection of suspicious event sequences. The Suspected Attacks page uses AI-assisted detection to identify and surface potential sequences of suspicious events across your cloud environment that together indicate a possible breach or attack in progress.

*** ### What Is an Attack Chain? An attack chain is a series of correlated events that suggest an attempt or successful data compromise. DataDefender maps detected events against MITRE ATT\&CK techniques and groups related events into a single chain so you can see the full picture of an attack rather than individual alerts. *** ### Status Filter Use the status filter buttons to narrow down the attack chains by their current state: | Status | Meaning | | ----------------------- | ---------------------------------------------------- | | **All** | Show every detected chain | | **Attacks** | Categorizes single activities that indicate attacks | | **Multi-Stage Attacks** | Categorizes multi-stage events that indicate attacks | The count next to each button shows how many chains are in that state. Click on a specific type of attack to see an icon-based view of potential threats.

*** ### Filtering and Sorting **Filtering:** Select the time zone and severity. Click 'More Filters' to access more granular controls like Account ID, Location, and more. You can also add filters to search for specific attacks. **Sort:** Use the sort dropdown to change the ordering (e.g. by date, severity, or completion). Use the arrow button next to it to toggle between ascending and descending order.

*** ### Attack Chain Cards Each card in the list represents one detected attack chain. Cards show: * Scenario name and description * Current status badge (Occurred / Attempted / Blocked / Incomplete) * Date of first and last detected activity Click a card to expand it and see the full attack details, including: * **Summary:** Brief summary of attack and outcome * **Affected resources:** Which storage resources were involved * **Threat Category:** Type of threat (Access Control, Data Exfiltration, etc.) * **Threat State:** Current threat level of the finding

*** ### Pagination Use the **Previous** and **Next** buttons to navigate through the list of attack chains. *** ### Related Pages * [Security Holes](/how-it-works/portal-overview/data-security-insights/security-holes): See the misconfigurations that may enable attacks * [Forensic Analysis](/how-it-works/portal-overview/supporting-information/forensic-analysis): Search raw CloudTrail logs for specific events * Consider checking [File Access by User](/how-it-works/portal-overview/supporting-information/forensic-analysis#file-access-by-user) to investigate which files were accessed by certain identities during a potential attack # Security Holes Evaluate configuration gaps. The Security Holes page evaluates your cloud storage resources against security best practices and flags misconfigurations, policy violations, and other weaknesses that could expose your data to risk.

*** ### Overview Each row in the findings grid represents a specific security check (e.g. "S3 bucket logging disabled" or "RDS instance not encrypted at rest") and shows how many resources failed that check. Expand any row to see the individual affected resources. *** ### Filters Use the filter bar to narrow down findings to what matters most to you.

#### Severity Filter Select one or more severity levels to include in the results: | Severity | Meaning | | ------------ | -------------------------------------------------- | | **Critical** | Immediate risk of data exposure or breach | | **High** | Significant risk that should be addressed promptly | | **Medium** | Moderate risk worth addressing in your next cycle | | **Low** | Minor risk or informational finding | By default, **Critical** and **High** are selected. #### Service Type Filter Filter findings by cloud service type. Current items include S3, EFS, FSx, and more. Add and remove resources in the 'Service' filter section. #### Result Filter | Option | Meaning | | ------------- | ----------------------------------- | | **Found** | The issue exists — the check failed | | **Not Found** | No issue — the check passed | By default, only **Found** results are shown (i.e. actual problems). #### Public Checks Toggle The **Public Checks** toggle in the filter bar shows or hides a subset of 14 checks specifically related to public access exposure. These span a range of AWS Services including S3, EBS snapshots, EFS, and more. They are hidden by default to reduce noise but are worth reviewing regularly. #### Open Issues Toggle Activate the 'Open Issues Only' toggle to only display findings that have currently open issues. Turn the slider off to view all issues that surface from the given filter. *** ### Findings Grid The grid shows one row per security check. Columns include: | Column | Description | | -------------- | -------------------------------------------- | | Check Name | Name of the security check | | Severity | Badge showing Critical / High / Medium / Low | | Account | AWS account where this was found | | Resource Count | Number of resources failing this check | | Last Updated | When this check last ran | Interact with the Filter section to surface the findings relevant to you.

*** ### View Options Use the view toggle in the top right to switch between: * **Findings view:** The default grid showing individual checks and resources * **Summary view:** An aggregated view grouped by category or severity * **Trends View:** A graph view describing open issues over time and number of open issues by severity

*** ### Remediating Findings DataDefender surfaces misconfigurations but does not automatically remediate them. Use the findings here as a prioritized list of actions to take in your AWS console or infrastructure-as-code tooling. For each finding, consider: 1. Is this a known/accepted risk? Document it in your risk register. 2. Is this a misconfiguration? Fix it in AWS and verify the check clears on the next scan. 3. Is this related to an active threat? Cross-reference with [Suspected Attacks](/how-it-works/portal-overview/data-security-insights/suspected-attacks). # Supporting Information Navigation hub for forensic and historical records. ## Supporting Information The Supporting Information page is a navigation hub that provides quick access to raw forensic data, access logs, and historical security records. Use these tools when investigating a specific incident or auditing access to your data.

*** ### Available Tools Click any card to navigate to the corresponding tool: | Card | What It Answers | Destination | | ----------------------- | ------------------------------------------------------- | ------------------------------- | | Classification History | What is the history of all classification changes? | Classification Details | | External Accounts | Which AWS accounts are accessing my resources? | External Accounts | | Actions Taken by Users | What API calls and actions have users performed? | Audit Activity | | Files Accessed by Users | Which specific files have users accessed? | Files Accessed by User | | Configuration Changes | What configuration changes have been made to resources? | Inventory > Configuration Drift | *** ### When to Use Supporting Information These tools are most useful during: * **Incident investigation** — A suspected attack or breach has been detected and you need to trace exactly what happened. * **Compliance audits** — You need to demonstrate who accessed what data and when. * **Access reviews** — You want to confirm that only authorized accounts and users are accessing your resources. * **Change management reviews** — You want to verify what configuration changes were made and by whom. For a guided investigation workflow, see [Forensic Analysis](/how-it-works/portal-overview/supporting-information/forensic-analysis). # Classification Details History of files matched to classification profiles. The Classification Details page shows the complete history of every file that has been scanned and matched a classification profile. Use this page to see exactly which files contain sensitive data, when they were scanned, and which data patterns were detected. We won't surface the exact text, but will report which classification rules were triggered.

*** ### Overview Unlike the Data Classification page which shows results grouped by resource, this page shows individual file-level results. Each row represents one file that matched a classification pattern. *** ### Data Grid Columns These columns are visible by default: | Column | Description | | ------------------ | ---------------------------------------------------------------------------------------------------- | | Date Scanned (UTC) | When the file was scanned and the classification result was recorded. Supports date range filtering. | | Resource Id | The identifier of the storage resource (e.g. S3 bucket) containing the file | | Object Path | The full path to the file within the storage resource | | Account | The AWS account ID where the resource lives | | Profiles | Badge display of all classification profiles that matched this file | #### Expanding a Row — Data Patterns Click the expand arrow on any row to see the **Data Patterns** that matched within that file. This detail panel lists each individual pattern (e.g. "Credit Card Number", "SSN") detected in the object. #### Hidden Columns The following columns exist in the grid but are hidden by default. Use the **Columns** panel (sidebar icon on the left of the grid) to show them: | Column | Description | | -------- | -------------------------------------------- | | Size | The amount of data processed during the scan | | Region | The AWS region where the resource is located | | Provider | The cloud provider (e.g. AWS) | | Error | Any error message recorded during scanning |

*** ### Filtering Each column has its own filter. Click the dropdown arrow in any column header to filter by that column's values. Each filter has 'Contains', 'Equals', or "Does not equal" options. For example, to see all files in a specific bucket that matched the "PII" profile: 1. Click the filter dropdown in the **Container / Bucket Name** column and select your bucket. 2. Click the filter dropdown in the **Classification Profile** column and select "PII".

*** ### Pagination Use the pagination controls at the bottom of the grid to navigate through results. You can also adjust how many rows are shown per page using the page size selector. *** ### Related Pages * [Data Classification](/how-it-works/portal-overview/data-security-insights/data-classification): See results grouped by resource rather than file * [File Access by User](/how-it-works/portal-overview/supporting-information/forensic-analysis#file-access-by-user): See who accessed the files that contain sensitive data # External Accounts Shows external AWS accounts accessing your resources. The External Accounts page shows all AWS accounts that have accessed your cloud resources, distinguishing between your own linked accounts and external or unknown accounts. Use this page to identify and review unexpected cross-account access.

*** ### Summary Cards | Card | What It Shows | | -------------------------- | ----------------------------------------------------------------------------------- | | Publicly Exposed Resources | Count of resources accessible by anyone on the internet (links to Public Resources) | | New External Accounts | Count of external accounts that have not yet been reviewed | | Trusted Vendors | Count of accounts that have been approved/whitelisted |

*** ### Status Tabs Accounts are organized into three tabs: | Tab | Meaning | | ---------------- | ------------------------------------------------------------------------------ | | **Needs Review** | External accounts that have accessed your resources but have not been assessed | | **Approved** | Accounts confirmed as trusted vendors or expected cross-account access | | **In Violation** | Accounts flagged as unauthorized or suspicious |

*** ### Reviewing External Accounts #### Approving an Account If an external account is a known trusted vendor or partner: 1. Select the account(s) using the checkboxes. 2. Click **Approve Selected**.

#### Flagging a Violation If an account should not have access: 1. Select the account(s) using the checkboxes. 2. Click **Flag as Violation**. #### Changing a Previously Set Status * From the **Approved** tab: use **Move to Needs Review** or **Flag as Violation** * From the **In Violation** tab: use **Move to Needs Review** or **Approve Selected** All action buttons are disabled until at least one account is selected.

*** ### Related Pages * [Public Resources](/how-it-works/portal-overview/data-security-insights/public-resources): Review publicly accessible resources * [Forensic Analysis](/how-it-works/portal-overview/supporting-information/forensic-analysis): Search CloudTrail logs to see what specific actions an account performed # Forensic Analysis Conduct forensic investigations. The Forensic Analysis page is an investigation hub that provides direct access to three forensic data tools: Audit Activity, File Access by User, and Configuration Changes. Use this page when you need to investigate a security incident, conduct an access review, or gather evidence for compliance. Keep in mind this feature set is made available via the Activity Monitoring feature set configured during Account Linkage.

*** ### Available Tools We offer three tools to assist with forensic analysis: Audit Activity, File Access by User, and Configuration Changes. This feature set is available when Activity Monitoring | Card | Description | Destination | | --------------------- | --------------------------------------------------------------------------------------------------------------- | --------------------- | | Audit Activity | Raw CloudTrail event logs with complete API call records. Search by user, event type, resource, and time range. | Audit Activity | | File Access by User | Detailed S3 access logs showing exactly which files each user or principal accessed, and what they did. | File Access by User | | Configuration Changes | Complete history of configuration changes to your cloud resources, with before-and-after snapshots. | Configuration Changes | *** ### Recommended Investigation Workflow When investigating a potential incident: 1. **Start with Audit Activity** to get a timeline of API calls and identify the account or user involved. 2. **Move to File Access by User** to determine if any sensitive files were accessed or exfiltrated. 3. **Check Configuration Changes** to see if the attacker made any changes to your infrastructure (e.g. disabling logging, modifying IAM policies, opening public access). 4. Cross-reference findings with Suspected Attacks to see if DataDefender has already correlated the events into an attack chain. *** ### Audit Activity The Audit Activity tool lets you search and query your AWS CloudTrail and S3 Server Access Logs. Use it to find out who did what, when, and on which resources.

#### Search Filters Build a query before fetching results. Click the **Search Filters** header to expand or collapse the panel. **Filter conditions** — Add one or more conditions to narrow results: | Field | Description | | --------- | --------------------------------------------------------------------- | | Attribute | The event property to filter on (e.g. Identity, Event Name, Resource) | | Operator | How to match: Equals, Contains, or Does Not Contain | | Value | The value to match against | Click **+ Add Condition** to add another row. Click **×** to remove a condition. **Date range:** Choose a preset (Last 24 hours, Last 7 days, Last 30 days) or select a custom start and end date. Click **Search** to run the query. Click **Reset** to clear all conditions. #### Tips * Start with a narrow date range if you know roughly when an event occurred — it returns results faster. * Filter **Event Name = GetObject** with a specific **Identity** to trace which files a user downloaded. * Filter **Status = Failed** to find unauthorized access attempts or permission errors. * Export to CSV options are available after a query is built. *** ### File Access by User The File Access by User tool provides granular S3 access logs showing exactly which files each user or service principal accessed, when they accessed them, and what they did.

#### Search Filters | Field | Description | | ---------- | -------------------------------------------------------- | | Identity | The AWS user, role, or service that performed the access | | Resource | The S3 bucket to search within | | Path | (Optional) A specific file path or prefix to filter to | | Date Range | The time window to search, in UTC | Select your criteria and click **Search** to load results.

#### Access Activity Grid Each row represents one file access event.

Column	Description
Date / Time	When the access occurred
Account ID	AWS Account ID
User	The identity that performed the access
Action	The action performed: GET (download), PUT (upload), DELETE (delete)
Resource Name	The resource container that was accessed
Object Path	The full path to the file within the bucket
Source IP	The IP address the request came from
Resource Type	The actual object type that was accessed
Event Name	Operation performed

#### Tips * Search by a specific user to see everything they accessed during a given time window. * Look for high-volume GET requests on a bucket as a sign of bulk data exfiltration. * A large number of DELETE operations may indicate data destruction. * Cross-reference the Source IP with known company IP ranges to identify access from unexpected locations. *** ### Configuration Changes The Configuration Changes tool is a daily audit log that tracks every resource added, deleted, or modified across your storage services. It is updated nightly and lets you filter changes by date range and expand any record to see a detailed before-and-after diff of exactly what changed.

#### Grid Columns | Column | Description | | --------------------- | ----------------------------------------------------------------------------------- | | Change Detected (UTC) | When the change was recorded. Supports date range filtering (maximum 31-day range). | | Change Type | What happened to the resource: Created, Modified, Deleted, or Baseline | | Account ID | The AWS account where the change occurred | | Location | The AWS region or location | | Resource ID | The identifier of the affected resource | | Resource Name | The name of the affected resource | | Resource Type | The type of AWS resource (e.g. S3 Bucket, RDS Instance) | All columns support filtering. Set filters (Account ID, Location, Resource Type, Change Type) show selectable values from your environment. Resource ID and Resource Name support text search (contains or equals). #### Change Types | Type | Meaning | | ------------ | ----------------------------------------------------------------------------- | | **Created** | A new resource was detected that did not exist before | | **Modified** | An existing resource had one or more configuration properties changed | | **Deleted** | A resource was removed | | **Baseline** | The initial snapshot recorded when DataDefender first discovered the resource | #### Viewing a Diff Click the expand arrow on any **Modified** row to see the detailed property-level diff. Each changed property is shown with its previous value and new value, displayed inline or side-by-side.

#### Tips * Use **Change Type = Modified** combined with a narrow date range to investigate what changed on a specific day. * If a security check finding appeared recently, check Configuration Changes for the same resource around the same date to see what was altered. * The **Baseline** change type is not an alert, it simply marks when DataDefender first recorded a resource's configuration. # Settings Configure DataDefender.


Classification Profiles	Classification Profiles
Agent Configuration	Agent Configuration
Notifications	Notifications
Users	Users
Child Organizations	Child Organizations
Linked Accounts	Linked Accounts

# Classification Profiles Define rules for classifying sensitive data. The Classification Profiles page is where you define and manage the rules DataDefender uses to classify your data. It has two tabs: **Profiles** (which group data patterns together) and **Custom Data Patterns** (individual detection rules).

*** ### Profiles Tab #### Predefined Profiles DataDefender ships with a set of built-in classification profiles based on common industry and compliance frameworks (e.g. PCI DSS, HIPAA, GDPR). These profiles are read-only and cannot be modified or deleted. | Column | Description | | ------------------- | --------------------------------------- | | Profile Name | Name of the predefined profile | | Data Patterns | Number of data patterns in this profile | | Resources Monitored | Number of resources currently monitored | | Last Hit | Last time a given profile was detected | Click **View Details** on any predefined profile to see which data patterns it contains. #### Custom Profiles Custom profiles are organization-specific profiles that you create and manage. They allow you to group data patterns that are relevant to your specific business context. | Column | Description | | ------------------ | ------------------------------------------------ | | Profile Name | Name of your custom profile | | Data Pattern Count | Number of data patterns assigned to this profile | | Status | Active or Inactive | **Actions per profile:** * **View:** View profile details including data patterns, creation date, status * **Edit:** Modify the profile name, status, or assigned data patterns * **Delete:** Permanently remove the profile (you will be asked to confirm)

**Creating a Custom Profile** 1. Click **Create New Profile**. 2. Enter a profile name. 3. Select data patterns from the library on the left. 4. Click **Add Selected Patterns** to assign them to the profile. 5. Set the profile status (Active or Inactive). 6. Click **Save Profile**.

*** ### Custom Data Patterns Tab Custom data patterns are individual detection rules, typically regular expressions, that define what counts as a match during a classification scan.

| Column | Description | | ---------------- | ------------------------------------------------------ | | Pattern Name | Name of the data pattern | | Severity | How serious a match is: Critical, High, Medium, or Low | | Detection Method | How matches are detected (e.g. Regex) | | Version | Pattern version number | | Actions | Modify or delete custom data pattern | **Actions per pattern:** * **Edit:** Modify the pattern definition * **Delete:** Remove the pattern (you will be asked to confirm) **Creating a Custom Data Pattern** 1. Click **Create Custom Data Pattern**. 2. Fill in the **Pattern Name** and select a **Severity** level. 3. Optionally add a **Description**. 4. Enter your **Regular Expression** in the detection field. Use the **Regex Syntax Guide** button for reference. 5. Use the **Testing Sandbox** on the right to paste sample text and verify your regex matches what you expect. 6. Optionally assign the pattern to one or more existing custom profiles. 7. Click **Create Data Pattern**.

*** ### Tips * Activate only the profiles relevant to your compliance requirements to reduce noise in classification results. * Test your regex patterns thoroughly in the sandbox before saving, incorrect patterns can produce false positives or miss real matches. * A data pattern can belong to multiple profiles. You do not need to duplicate patterns if they apply to more than one framework. # Agent Configuration Manage AWS scanning agent deployments and settings. The Agent Configuration page lets you manage the file scanning agents that DataDefender deploys into your AWS environments. These agents perform the actual content scanning of your storage resources to detect sensitive data patterns.

*** ### Deployments Grid Each row in the grid represents a deployed scanning agent configuration for a specific AWS account and region. | Column | Description | | ---------- | ----------------------------------------------------------------------------- | | Provider | Cloud Provider | | Account ID | Cloud Account ID | | Region | The region where agents are deployed | | Errors | If the Agent has any current errors. Hover over message to see error messages | | Status | Agent status (Active, Inactive) | *** ### Configuring a Deployment Click the **Configure** button (settings icon) on any row to open the configuration dialog.

| Field | Description | | --------------- | --------------------------------------------------------------------------------------------------------------------- | | Min Agents | The minimum number of agents that should always be running | | Max Agents | The ceiling for auto-scaling during high scan volumes | | Queue Threshold | How many pending jobs must accumulate before scaling up. Will be automatically set to 1 if Smart Scanning is enabled. | | CPU | CPU allocation per agent | | Memory | Memory allocation per agent | | Disk Size | Disk size per agent | | Smart Scanning | When enabled, agents shut down when idle and only start when there is scanning work to do. This reduces AWS costs. | Click **Save** to apply changes or **Cancel** to discard them. *** ### Enabling and Disabling a Deployment Click the button with 3 dots then the toggle button on a deployment row to enable or disable it: * **Disabling** a deployment stops active scanning for all containers in that region. When disabled, Smart Scanning is automatically enabled so agents will still run if there is a backlog, but will not run continuously. * **Enabling** resumes normal active scanning. You will be asked to confirm before the change is applied.

*** ### Deleting a Deployment Click the **Delete** button (trash icon) on a row to remove a deployment entirely.

You will be asked to confirm the deletion. Note that deleting a deployment is permanent. Some resources may require manual cleanup in AWS after deletion. If so, a warning will appear listing the resources that need attention. *** ### Related Pages * [Linked Accounts](/how-it-works/portal-overview/settings/linked-accounts): AWS accounts must be linked before deployments can be created for them * [Classification Profiles](/how-it-works/portal-overview/settings/classification-profiles): Define what data patterns agents scan for * [Classification Details](/how-it-works/portal-overview/supporting-information/classification-details): View the results produced by scanning agents # Notifications Configure external alerts for DataDefender. The Notifications page lets you configure the channels through which DataDefender sends security alerts. You can add multiple channels of different types so that alerts reach the right people through the right tools.

*** ### Summary Cards When channels are configured, summary cards at the top show: | Card | Description | | -------------------- | --------------------------------------------- | | Total Channels | How many notification channels are configured | | Active Channels | Channels currently receiving alerts | | Channels with Errors | Channels that have recently failed to deliver | | Disabled Channels | Channels that have been turned off | *** ### Adding a Channel Click **Add Channel** (+ icon) in the top right to open the channel creation dialog.

1. Select the channel type. Currently we support SNS and Webhooks, but more options will be added soon. 2. Fill in the required configuration for that channel type: * **Webhook:** Enter the endpoint URL * **SNS**: enter the Provider Connection, SNS Topic ARN, and SNS Topic Region 3. Click **Create** to save the channel. *** ### Channel Cards Each configured channel appears as a card showing: * Channel name * Channel type * Status badge (Active / Disabled / Error) * Error message (if the channel has recently failed) * Last tested timestamp **Actions per channel:** | Button | Action | | ---------- | --------------------------------------------------------------------- | | **Edit** | Opens the channel configuration form pre-filled with current settings | | **Test** | Sends a test notification through this channel immediately | | **Delete** | Permanently removes the channel | *** ### Editing a Channel Click **Edit** on any channel card to update its configuration. Make your changes and click **Save.** # Users Manage user accounts, roles, and passwords. The Users page provides administrative control over who has access to DataDefender. Use it to create new user accounts, manage roles, reset passwords, and remove users who no longer need access. While email is the only configuration for users at the moment, roles, names, and statuses will be added shortly.

*** ### User Grid The grid lists all users in your organization. | Column | Description | | ------------------- | ------------------------------------- | | Email | User's email address (used for login) | | Status | Active, Inactive | | Organization Access | Organizations users have access to | | Actions | Edit, Reset, Delete options | *** ### Creating a User Click **Create User** to go to the new user form. Fill in the user's email then save. *** ### Editing a User Click the **Edit** button on any user row to open their profile and modify their email. *** ### Resetting a Password If a user is locked out or needs their password reset: 1. Click the **Reset Password** button on the user's row. 2. Confirm the action in the dialog and a password reset email will be sent to the user's email address.

The user will receive an email with a link to set a new password. *** ### Deleting a User To remove a user's access entirely: 1. Click the **Delete** button on the user's row. 2. Review the confirmation dialog which shows the user's email. 3. Click **Delete** to confirm.

This action is permanent. The user will immediately lose access to DataDefender. *** ### User Roles | Role | Access Level | | ---------- | ---------------------------------------------------------------------------------- | | **Admin** | Full access to all features including settings, user management, and configuration | | **Viewer** | Read-only access to security data; cannot change settings or manage users | | **Custom** | Configurable permissions (contact your account manager for details) | # Child Organizations Create logical groupings of cloud accounts. The Child Organizations page lets you create logical boundaries within DataDefender to isolate data between different clients, business units, or environments. This is typically used by managed service providers (MSPs) or enterprises that want to separate visibility between teams.

*** ### Creating a Child Organization Click **Create Child Organization** to go to the creation form.

Fill in the organization name and configure the administrative email address, then save. *** ### Editing a Child Organization Click the **Edit** button on any row to modify the name or primary contact email.

*** ### Deleting a Child Organization Click the **Delete** button on a row to remove a child organization.

You will be asked to confirm the deletion. **Important:** Deleting a child organization removes access for all users assigned to it. The underlying AWS accounts and their data are not deleted, but users will lose their scoped access. *** ### How Child Organizations Work * Each child organization has its own set of linked AWS accounts and users. * Users assigned to a child organization only see data from the accounts within that organization. * Admin users at the parent organization level can see across all child organizations. * AWS accounts can only belong to one child organization at a time. *** ### Related Pages * [Linked Accounts](/how-it-works/portal-overview/settings/linked-accounts): AWS accounts must be linked before they can be assigned to a child organization * [Users](/how-it-works/portal-overview/settings/users): Create users and then assign them to child organizations # Linked Accounts Link accounts to ingest data.

## Linking Accounts To get started, you will deploy our CloudFormation stack into the first AWS account which you would like to us to ingest data from, confirm the stack creation in DataDefender, and we'll begin ingesting data. You can link as many AWS accounts as you would like using the following method. Linking an Account is a 4 step process. This page will detail how to complete each step. * Initiate Deployment from DataDefender * Configure and deploy CloudFormation stack from AWS * Link the stack to DataDefender * Confirm Deployment ### 1. Initiate Deployment from DataDefender In order to do this, navigate to **Linked Accounts** and click the ![](https://3802454275-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FobDf5vJfItiNrkno1uJc%2Fuploads%2F0nI4XausUEZEuue5YAl2%2Fimage.png?alt=media\&token=b3bc3df3-828c-4243-9c7a-abb37265de8e) button. In the next page, fill out the following: 1. Name your CloudFormation Stack. 2. Indicate the region your stack should reside in. 3. The next four settings determine whether our app will have access to and try to retrieve data for the [S3 Inventory](broken://pages/G3G7kTHU4NQAVc5Mj3V3), [EBS Inventory](broken://pages/GkxDV5sDNAvYlHSbi6Y4), [File Systems](broken://pages/9Lb4diPpJWfoYW4DOaIY), and [Security Checks](broken://pages/9gYrAVOTscS3su5JVvGC) feature sets. If you select any of these settings, DataDefender will provision the necessary permissions required to gather information for these feature sets. 4. Decide whether to enable the Activity Monitoring CloudTrail Feature Set. DataDefender uses this information in its [Monitoring](broken://pages/sDPQ1rUfPNAlzMF0D2jc) and [File Access Report](broken://pages/9Lb4diPpJWfoYW4DOaIY) features. The form requires an existing CloudTrail Trail and the S3 Bucket ARN of where the Trail is logging into. Place that ARN into the form.\ Please refer to the [Configuration CloudTrail Log Bucket](#configuring-cloudtrail-log-bucket) section for more details. 5. Decide whether to enable the Activity Monitoring S3 Server Access Logs Feature Set. DataDefender uses this feature in its [Monitoring](broken://pages/sDPQ1rUfPNAlzMF0D2jc) and [File Access Report](broken://pages/9Lb4diPpJWfoYW4DOaIY) features. The form requires Server Access Logging enabled. We accept one S3 Bucket as input so ensure all buckets are pointing to one logging bucket. Place the ARN of that bucket into the form.\ Please refer to the [Configuring Server Access Log Bucket](#configuring-server-access-log-bucket) section for more details. ### 1. Initiate Deployment from DataDefender In order to do this, navigate to Settings > **Linked Accounts** and click the "Link New Account" button. The following form will assist in linking an AWS Account. #### Account Details

Parameter	Function	Example Values
Stack Name	What your stack will be named	my-stack
ActivityMonitoringCloudTrailQueueName	Optional; name to give the created Activity Monitoring SQS queue.	datadefender-activity-monitoring-ct
ActivityMonitoringCloudTrailS3BucketArn	The ARN of the S3 bucket that CloudTrail events are logged to.	arn:aws:s3:::example
ActivityMonitoringS3ServerAccessLogsBucketArn	The ARN of the S3 bucket that S3 server access logs are logged to.	arn:aws:s3:::example
ActivityMonitoringS3ServerAccessLogsQueueName	Optional; name to give the created Activity Monitoring S3 Server Access Logs SQS queue.	datadefender-activity-monitoring-sal
ConnectionManagementType	Whether the connection is self-managed or is a manager of other connections.	Self, Managed
EnableActivityMonitoringCloudTrailFeatureSet	Pick Yes if you would like to enable the activity monitoring feature set for a CloudTrail event source.	Yes, No
EnableActivityMonitoringS3ServerAccessLogsFeatureSet	Pick Yes if you would like to enable the activity monitoring feature set for a S3 Server Access Logs event source.	Yes, No
EnableEBSInventoryFeatureSet	Pick Yes if you would like to enable the EBS Inventory feature set.	Yes, No
EnableFileSystemsInventoryFeatureSet	Pick Yes if you would like to enable the File Systems Inventory feature set.	Yes, No
EnableS3InventoryFeatureSet	Pick Yes if you would like to enable the S3 Inventory feature set.	Yes, No
EnableSecurityChecksFeatureSet	Pick Yes if you would like to enable the security checks feature set.	Yes, No
IamRoleNameSuffix	Optional; suffix to include in the created IAM role. May be required if there are IAM role name conflicts.	CloudStorageSec
IdentityProviderUrl	The URL of the Cloud Storage Security identity provider to verify the identity when assuming the role. Do not include https:// in the URL. This does not have to be modified.	auth.datadefender.io/realms/datadefender

#### Optional: Activity Monitoring If you enabled Activity Monitoring with CloudTrail or S3 Access Logging, complete **Configure Activity Monitoring**. (Otherwise, disable both CloudTrail and S3 Server Access Logs checkboxes and skip this step.) * Paste the **CloudTrail Queue** value from the Outputs into the *CloudTrail queue name* field, and select the region where the queue resides. * Paste the **S3 Access Logging Queue** value from the Outputs into the *S3 queue name* field, and select the region where the queue resides.

## Configuring Log Buckets for Activity Monitoring (Optional) In order for DataDefender to ingest logs for its Monitoring and File Access Report features, you'll have to point it to buckets which store the logs. Here's how to configure both of them. ### Configuring CloudTrail Log Bucket 1. In AWS, navigate to CloudTrail. 2. Click 'Create Trail' in the 'Trails' section.

3. In your Trail Attributes: 1. Set a trail name and decide whether to create a new S3 bucket to use an existing S3 bucket. 2. Decide whether to use SSE-KMS. If enabled, set a new or existing KMS key. 3. Decide whether to use Log File Validation. Read more from AWS' documentation [here](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-log-file-validation-intro.html?icmpid=docs_console_unmapped). 4. Decide whether to enable SNS notification delivery. SNS will notify you every time a new log enters your Trail bucket, and you will have to configure a topic to notify through. 5. Decide whether to funnel logs to CloudWatch Logs. 6. Add Optional Tags. 7. Click Next. 4. In your Log Events: 1. Select Management Events and Data Events. 2. In Management Events, leave the activity as Read and Write. 3. In Data Events, choose Resource type as S3. 4. Click Next.

5. In the Review and Create page: 1. Verify all information looks correct. 2. Click 'Create trail'. After the Trail has been created, navigate to S3 and find the bucket where your Trail is logging to. Copy the bucket ARN, and place that into your 'Activity Monitoring CloudTrail Log Bucket ARN' section. Refer to [Optional: Activity Monitoring](#optional-activity-monitoring) for next steps. ### Configuring Server Access Log Bucket There may be multiple buckets you want to monitor access on. For each of those buckets, enable Server Access Logging and point to the same S3 bucket. Here's how to do it through the AWS Console. {% hint style="info" %} As a prerequisite, create an S3 bucket where you want all your server access logs to go to. {% endhint %} For each bucket you want DataDefender to access: 1. Navigate to that S3 bucket 2. Click 'Properties' and navigate to 'Server access logging'. Click 'Edit'.

3. Toggle 'Server access logging' to 'Enable' and specify the aformentioned S3 server access logs bucket. 4. Decide the Log object key format. 5. Select 'Save changes'. Navigate back to S3 and find the bucket where your Server access logs are pointed to. Copy the bucket ARN, and place that into your 'Activity Monitoring S3 Server Access Log Bucket ARN' section. Refer to [Optional: Activity Monitoring](#optional-activity-monitoring) for next steps. # Release Notes What's new with DataDefender? On this page, we'll be tracking additions to DataDefender starting from December 2025. Each month will have New, Improved, and Fixed items. ## October 2026 **Regional Availability** * AWS Canada Region Deployment\ ⚬ Added a dedicated DataDefender deployment within the AWS Canada Region to support customers with strict data residency and compliance requirements. **Google Drive Enhancements** * Public File Indicators * Added visual indicators within Data Stores to easily identify drives containing publicly shared files. * Expanded Data Store Visibility * When expanding a Drive within the Data Stores view, you can now see the count of externally shared files that contain Classification Matches, by Classification Profile. * Optimized Inventory Collection * Improved the inventory collection engine to reduce provider API requests and increase overall sync efficiency. **Exposure Discovery** * Code Repository Filtering * Scan results can now be filtered and viewed by individual repository. * Target List Next Scan Column * Added a "Next Scan" column to the target lists to provide immediate visibility into upcoming scan schedules. **Security Holes** * Multi-Cloud Usability Improvements * Cloud Provider Filter: Filter Security Holes results by specific cloud providers. * Provider Icons: Added visual provider icons to each check for quicker identification. * Provider Column: Added a dedicated Provider column to the Findings view. *** ## September 2026 **Core Platform Support** * Microsoft Azure * You can now link your Azure Subscriptions to DataDefender, allowing you to inventory and classify the content of your organization’s storage accounts. * Public blob containers can be managed within the Public Resources page. * Security Holes will monitor your Azure storage accounts to find configuration issues such as: * Storage Accounts Not Enforcing Minimum TLS 1.2 * Storage Accounts with Blob Anonymous Access Enabled * Storage Accounts Not Enforcing AES-256-GCM for SMB * And many more…. * Microsoft OneDrive and Sharepoint * Linking your Microsoft 365 tenant allows DataDefender to safely inventory personal and shared drives, as well as classify the contents within to find sensitive data. * Google Drive * Security Holes will monitor your Azure storage accounts to find configuration issues such as: * External Users Allowed to Move Shared Drive Content Outside the Organization * Google Drive Shared Drive Managers Allowed to Override Security Settings * Google Drive Files in Shared Drives Sharable with Non-Members * Plus more… * AWS * 5 additional Security Hole checks have been added Exposure Discovery * This new feature suite is designed to help you discover what your organization exposes publicly — from cloud credentials to storage and shared resources. It allows you to enter specific targets, which DataDefender will monitor and catch when credentials, keys, or other critical components are shared publicly. With this suite you can monitor: * Websites - Enter your websites and let our scanner crawl the sites, map the cloud footprints, and report only what the site actually exposes: storage, leaked credentials, AWS accounts, and web technology, backed by the evidence that proves it. * Public Github Repositories - Scan public GitHub repositories for exposed secrets, cloud storage locations, and AWS account IDs. * Public Asset Finder - Enumerate an AWS account's publicly-shared resources. DataDefender inventories the public EBS snapshots, RDS snapshots, AMIs, and more that the account exposes to the internet. You can then execute sensitive data scans against these exposed resources. *** ## August 2026 **New Platform Support** * Google Drive Workspaces * You can now link your Google Drive workspaces to DataDefender, allowing you to inventory and classify the content of your organization’s drives and shared drives. * EBS Scanning * Classification scans can now be executed against both EBS Volumes and EBS Snapshots through the Data Stores page.
**Proactive Protection** * Exposure Discovery Suite * A suite of tools that will discover what your organization exposes publicly — from cloud credentials to storage and shared resources. * Web Exposure Scan * Discovers what your public websites reveal about your infrastructure * S3 Bucket Search * Search a continuously-indexed catalog of known public S3 buckets. * Public Asset Finder * Enumerates your AWS account's publicly-shared resources. * Public Asset Classification Details * View the results of classification scans against your publicly-shared resources. * Auto-Classify S3 Buckets * You can now set your S3 buckets to automatically classify files as they are uploaded. This allows you to ensure no sensitive data is uploaded by mistake or to the wrong bucket. Auto-Classify is managed within the Data Stores page.
**Notifications** * Added support for Slack Webhooks (in addition to SNS and general webhooks) * More notification types available * Classification Results * Option to include/exclude scanning errors * Security Holes * Public Resources * Daily Public Resources Email * Opt-in directly from the Public Resources Page
**Managed Data Refresh** * Through the Health page you can now: * Manually refresh inventory collection * Manually refresh security checks * Monitor any issues with data collection * See what’s failed or when data is not fresh * See the platform health status
**S3 Bucket Insights** * The Data Stores page has been updated to provide better details and insights of your S3 buckets, including: * The ability to run an intelligent analysis of the content of your bucket. This will help you understand the type of data and potential uses for your data stores. * File name-based classification * File type breakdown
**Linked Account Security Improvements** * Leveraging CloudFormation change sets, any requested updates to the linked account configuration must be reviewed and approved within AWS before they can be applied. This ensures that no privileges are escalated without approval.
**General Improvements** * Added the ability to link from an Attack to its corresponding Forensics results for deeper investigation. * Improved the layout of the Public Resources page for ease of use. *** ## June 2026 ### New Features #### Product Onboarding & Evaluation * Interactive Sample Organization Environment * Implemented a new Sample Organization feature, allowing users to safely interact with the console, view live dashboards, and explore features populated entirely with rich test data. #### Data Classification * Data Pattern Import & Export * Added the ability to import and export custom Data Patterns via the Classification Profiles page, enabling seamless rule-sharing and backup. * Profile Versioning Support * Expanded foundational versioning support to include full Data Classification Profiles versioning, making it easier to track changes over time. #### Remediation & Risk Management * Direct S3 Public Access Revocation * Added the capability to directly revoke public access to exposed S3 buckets straight from the Public Resources interface. * NOTE: You must grant permissions for this within the Settings > Cloud Connectivity page. #### Support & System Status * Public Health Dashboard Link * Added a direct link to the public-facing DataDefender system health status dashboard in the left-hand navigation menu. #### Threat Detection & Reporting * Attack Summary Tab * Added a dedicated Summary tab to the primary Attacks page, instantly highlighting the most critical, high-level details of any potential security incident. * New Multi-Stage Attack Scenario: * Pacu Execution Detection: Automatically identifies and alerts on automated, multi-step cloud exploitation techniques driven by the Pacu open-source penetration testing framework. * New Threat Signatures: * EC2 Userdata Injection: Detected when cloud instance startup scripts are modified, indicating potential persistent backdoor or malware injection. * EBS Snapshot Exfiltration: Detected when infrastructure volume snapshots are shared externally or modified for outside access. * Secrets Manager Credential Access: Detected when an anomalous burst of secret retrieval requests targets AWS Secrets Manager. * Permission Bruteforce Detection: Detected when an entity generates rapid, repeated authorization failures while guessing API permissions. * S3 Public Access Block Removal: Detected when account-level or bucket-level Public Access Blocks are deactivated, risking data exposure. ### Improvements #### Cross-Navigation & Drilldowns * Data Stores to Classification Pivot * Added contextual drilldown links from the Data Stores inventory straight to the Data Classification dashboard for any asset containing active matches. * Classification to Deep-Dive Details Pivot * Added direct drilldown links from the main Data Classification screen straight to the granular Data Classification Details file view for any selected data store. * Expanded Asset Details View * Updated the Data Classification page to instantly display all matched Data Profiles whenever an individual asset row is expanded. #### User Experience & Interface * Redesigned Public Resources Dashboard * Completely redesigned the layout and data presentation of the Public Resources page for a cleaner, more actionable workflow. * Optimized Organization Selection * Refined and improved the core Organization Selection screen. #### Data Classification Engine * Streamlined Agent Configuration Syncing * Improved the backend process for communicating real-time configuration updates to already-deployed Data Classification scanning agents. * Long-Running Job Management * Enhanced how the platform handles, optimizes, and executes massive, long-running Data Classification jobs. * Job Monitor Activity Filtering * Added the ability to filter the Data Classification Job monitoring page specifically by assets that returned matched data results. *** ## May 2026 ### New Features #### Account & Organization Management * AWS Organizations Onboarding * Added the capability to onboard entire AWS Organizations at scale, simplifying multi-account management. * Platform Re-Branding: Cloud Connectivity * Re-named "Linked Accounts" to Cloud Connectivity across the console to better reflect the platform's core infrastructure integration. #### Role-Based Access Control (RBAC) * Read-Only User Role * Introduced a dedicated Read-Only user role to allow viewing and auditing without permitting configuration changes. #### Data Classification & Inventory * Centralized Job Monitoring * Introduced a new Data Classification Jobs monitoring page under Settings to track active and historic scan statuses in real time. * Unencrypted Asset Filtering * Added the ability to filter the core Data Stores page to isolate resources that do not support encryption. * New Data Classification Profiles: * Compliance * Sensitivity #### Querying, Reporting & Exporting * Query Builder Exporting * Added the ability to export search and analysis results directly from the Audit Activity page. * Unified Activity Query Experience * Combined the Audit Activity and File Access Report into a single, unified activity query engine for streamlined investigations. #### Threat Detection & Reporting * New Multi-Stage Attack Scenario: * Privilege Escalation via PassRole Abuse: Automatically identifies and alerts on multi-step techniques where an identity exploits iam:PassRole permissions to elevate its authority. * New Threat Signatures: * Security Group Backdoor: Detected when firewall rules are modified to allow unauthorized, persistent inbound access. * VPC Flow Log Deletion: Detected when network traffic logging is disabled, disrupting primary network forensic trails. * AMI Backdoor: Detected when a machine image is modified or shared externally, risking intellectual property exposure. * EC2 Key Pair Creation: Detected when new virtual machine access keys are generated, indicating potential unauthorized persistence. * Secrets Manager Credential Access: Detected when a burst of sensitive secrets or credentials are read from AWS Secrets Manager. * SSM Parameter Store Credential Access: Detected when unauthorized API calls target sensitive parameters stored in Systems Manager. * GuardDuty Tampering: Detected when native cloud threat detection features are disabled, paused, or deleted. * Config Service Disruption: Detected when configuration recorders are stopped, halting compliance tracking. * IAM Enumeration Burst: Detected when an identity rapidly probes identity permissions, indicating pre-attack mapping. * EC2 Enumeration Burst: Detected when an identity rapidly scans for virtual machines and infrastructure layouts. ### Improvements #### User Experience * External Accounts Updates * Improved the overall layout and user experience of the External Accounts page. * Contextual Classification Navigation * Added cross-navigation drilldown links to the primary Data Classification dashboard for faster data store pivots. * Enhanced Profile Sandbox Experience * Improved the layout and responsiveness of the Regular Expression test sandbox within custom Data Classification Profiles. #### Threat Detection & Analytics * Accelerated CloudTrail Processing * Optimized the underlying CloudTrail event processing engine to deliver significantly faster security alerting. * Refined Attack Severity Categories * Updated and recalibrated attack severity groupings to align more accurately with risk potential. * IAM Role Visibility in Attacks * Improved how IAM Roles are displayed and presented within the context of active Attack pages. #### Navigation & Pagination * Multi-Stage Attack Interface Controls * Updated the layout of the Multi-Stage Attacks page for better ease of use. * Multi-Stage Attack Pagination * Added explicit pagination controls to the Multi-Stage Attacks page to improve load times and navigation across large lists. *** ## April 2026 ### New Features #### Integrations & Notifications * Slack and Webhook Notifications * Added native support for forwarding security alerts and system notifications directly to Slack channels and custom Webhooks. #### Inventory & Data Asset Discovery * EBS Snapshots Coverage * Expanded the Data Store Inventory to include Amazon EBS Snapshots for broader infrastructure visibility. * RDS Snapshots Coverage * Expanded the Data Store Inventory to include Amazon RDS Snapshots. * Cloud Backup Volume Visibility * Added dedicated tracking for cloud Backups within the central Data Store Inventory. * IAM Data Collection * Added full support for incorporating AWS Identity and Access Management (IAM) data into the platform's core data collection process. #### Threat Detection & Reporting * Interactive Scenario Library * Introduced the Scenario Library for Multi-Stage Attacks, providing a reference framework to understand mapped attacker techniques. * Real-Time and Historic Attack Tracking * Added explicit support for distinguishing between "In-Progress" and historical "Occurred" Multi-Stage Attacks. * New Threat Signatures: * Mass Encryption: Detected when rapid, widespread encryption occurs, a primary indicator of active ransomware. * Unused High-Privilege Access: Detected when a highly privileged identity exhibits unusual activity after long periods of dormancy. * RDS Snapshot Bulk Deletion: Detected when multiple database snapshots are deleted in quick succession, threatening data recovery. * S3 Bucket Wipe: Detected when catastrophic, automated deletion commands are executed across an entire S3 bucket. * S3 Object Lock Governance Bypass: Detected when an identity attempts to override or delete S3 objects protected by Governance-mode retention. * S3 Legal Hold Bulk Removal: Detected when explicit legal holds are lifted from a large number of S3 objects simultaneously. * S3 Lifecycle Rapid Expiration: Detected when lifecycle policies are modified to prematurely expire and delete massive amounts of data. * S3 Object Lock Configuration Weakened: Detected when bucket-level object lock settings are modified or disabled. * S3 Object Version Purging: Detected when permanent deletion commands are targeting older, archived object versions. * Excessive API Calls: Detected when an anomalous volume of API requests originates from a single identity, indicating scraping or denial-of-service attempts. * S3 Backup File Deletion: Detected when targeted deletion events impact known backup archives stored in S3. * S3 Server Access Logging Disabled: Detected when access logging is turned off on a bucket, blinding forensic audit trails. ### Improvements #### User Experience & Onboarding * Redesigned Account Onboarding Flow * Completely redesigned the Link Account process to deliver a smoother, more intuitive initial onboarding experience. * Enhanced Threat Summary Dashboards * Improved the overall data presentation and visualization within the primary Threat Summary views. * Intelligent Credential Error Handling * Improved how the platform handles and surfaces alerts when linked account credentials become invalid or expire. #### Data Classification & Inventory * Archived File Classification * Improved the underlying data classification engine to better support and extract text from compressed and archived file formats. * Data Pattern Inventory Filtering * Added the ability to filter the core Data Stores page by specific Data Pattern matches. * Classification Details Layout Polish * Improved sorting and filtering capabilities within the deep-dive Classification Details page. #### Vulnerability & Risk Management (Public Resources) * Cross-Navigation Public Resource Drilldowns * Added contextual, cross-navigation drilldown links directly to the Public Resources page for faster investigation. #### Threat Detection & Analytics * Cloud Intrusion Scenario Refinement * Enhanced the behavioral detection logic for the core Cloud Intrusion multi-stage attack scenario. * Attacks Interface Filtering * Improved the sorting, filtering, and isolation controls within the main Attacks pages. #### Performance & Scalability * Optimized S3 Inventory Collection * Reduced the overall volume of client-side API calls required to fetch and process S3 inventory data, minimizing API overhead. *** ## March 2026 ### New Features #### User Experience & Navigation * Global Organization Dropdown * Added a new Organization dropdown menu to the global header, allowing users to rapidly switch between different Organizations. * Streamlined Left Navigation * Re-organized the primary left-hand navigation menu to improve overall discoverability and ease of use. #### Account & Configuration Management * Linked Account Removal * Added the capability to fully remove linked accounts directly from the console. * Automated CloudFormation Template (CFT) Updates * Added the ability to automatically update the linked account CloudFormation Template whenever configuration changes are made. #### Data Classification * Centralized Data Classification Dashboard * Introduced a new Data Classification Page to view, analyze, and filter all assets containing classification matches. * Deep-Dive File Details View * Introduced a new Data Classification Details page, allowing users to view all specific files that triggered classification matches. * Data Pattern Versioning * Added foundational support for Data Classification Data Patterns versioning to better manage rule updates over time. * Intelligent Smart Scanning * Added support for Smart Scanning within the Data Classification scanning agents, allowing them to automatically shut down when not in use to optimize resource consumption. * New Data Classification Profiles: * Access Management * Connectivity Secrets * Cryptographic Material * Financial Data * Government Identifiers * Identity Data * Infrastructure Secrets * Private Keys #### Threat Detection & Reporting * Executive Threat Report Summary * Introduced a new Threat Report summary page designed to provide a high-level, executive overview of current active threats. * Multi-Stage Attack Reporting * Introduced a new Multi-Stage Attack report that automatically identifies, links, and analyzes complex, multi-step attack patterns. * New Threat Signatures: * Archival settings modified: Detected when long-term storage or archival configurations are altered, risking data retention compliance. * Unexpected EBS snapshot deletion: Detected when an Amazon EBS snapshot is deleted outside of normal operational patterns. * Access control list modified to 'Everyone': Detected when a resource ACL is opened broadly to the public. * AWS Security Service Disabled: Detected when critical cloud security services are deactivated. * Bucket Versioning Disabled: Detected when versioning is turned off on an S3 bucket, increasing risk of unrecoverable data loss. * MFA Delete Bypass via S3 Versioning Manipulation: Detected when advanced S3 versioning actions are used to circumvent MFA delete requirements. * Mass Deletion: Detected when an unusually high volume of resources or files are deleted in a short timeframe. * Rapid File Rename Pattern: Detected when multiple files are quickly renamed, a common indicator of ransomware activity. * Unused High-Privilege Access: Detected when a highly privileged identity exhibits unusual activity after long periods of dormancy. * SAML Provider Metadata Changed: Detected when federation settings are modified, indicating potential identity provider tampering. * OIDC Provider Thumbprint Changed: Detected when OpenID Connect configurations are altered, risking unauthorized authentication trusts. * Access Key Backdoor Detection: Detected when subtle access key modifications mimic stealthy persistent access techniques. * High Access Denied Rate: Detected when an identity generates an extreme volume of authorization failures over a brief period. * Privilege Escalation Scan: Detected when an entity performs targeted API calls to probe for misconfigured permissions. * Lambda Code Injection: Detected when unauthorized code modifications are attempted on serverless functions. * Bedrock Model Invocation Abuse: Detected when anomalous or malicious request volume is directed at Amazon Bedrock AI models. * Excessive Role Assumption: Detected when an identity rapidly assumes multiple distinct IAM roles, indicating lateral movement. * S3 Replication Deleted: Detected when cross-region or cross-account bucket replication is removed, impacting disaster recovery. ### Improvements #### User Experience * Dark Mode Optimization * Improved the overall Dark Mode presentation across the entire console for better readability and contrast. * Enhanced External Accounts Mapping * Improved how public, internal, and external accounts are visually categorized and presented within the External Accounts page. * User Management Polish * Added comprehensive filtering and sorting options to the User Management page for more efficient administration. * Public Resources Interface Updates * Improved the user experience and layout of the Public Resources page. #### Vulnerability & Risk Management (Security Holes) * Security Holes Layout Enhancements * Improved the core user experience and data density within the Security Holes page. * Service-Based Filtering * Added the ability to filter Security Hole findings by specific cloud services. * Public Resource Check Suppression * Added the ability to filter out public resource checks from the main Security Holes view to minimize noise. #### Data Classification * Automated Agent Updates * Automated the backend process for deploying routine updates to the Data Classification scanning agents. #### Threat Detection & Analytics * Advanced Ransomware Note Detection * Improved the behavioral detection engine responsible for identifying ransomware notes and extortion text. * Refined Malicious File Extensions Engine * Enhanced the coverage and accuracy of the Malicious File Extensions threat signature. *** ## February 2026 ### New Features: #### Threat Detection * New Threat Signatures: * Role Trust Policy Modification: Detected when changes are made to a role’s trust relationship, potentially allowing unauthorized cross-account access or privilege escalation. * Access Key Persistence: Detected when new long-term access keys are created, indicating a potential backdoor for persistent account access. * Access Denied Event: Detected when a spike in authorization failures occurs, highlighting potential discovery or brute-force activity. * Privilege Escalation Attempt: Detected when an identity attempts to gain higher-level permissions than currently assigned. * Prowler Tool Detection: Detected when security assessment activity from the Prowler open-source tool is identified within the environment. * ScoutSuite Tool Detection: Detected when infrastructure auditing activity from the ScoutSuite multi-cloud security tool is identified within the environment. ### Improvements #### User Experience * Enhanced External Accounts Interface * Updated the user experience for onboarding AWS accounts, making the process easier and more intuitive. * Direct AWS Console Linking * Added direct links from discovered assets to the AWS console, allowing you to view and manage specific resources instantly. #### Data Classification * Optimized Scanning Agent Deployment * Improved the AWS CloudFormation process for deploying classification scanning agents, resulting in a smoother setup experience. * Streamlined S3 Bucket Collection * Enhanced the data collection process for Amazon S3 buckets to increase discovery efficiency and reliability. #### Threat Detection & Analytics * Refined Threat Severity Determination * Upgraded the underlying logic used to calculate threat severity, ensuring more accurate prioritization of critical alerts. ## January 2026 #### New * New Signature Added: CloudTrail Logging Disabled * This signature tracks when CloudTrail logging is disabled

* New Signature Added: Cloudtrail Trail Deleted * This signature tracks when CloudTrail Trails are Deleted

* New Signature Added: CloudWatch Log Group Deleted * This signature tracks when CloudWatch Log Groups are deleted.

* Child Organizations will now show nested organizations in the UI

* Users now enter the Launchpad upon sign-in. Utilize the Launchpad to jump to the functionality that matters for you.

#### Improved * 'Sensitive Data' columns are hidden and 'Risk Signals' columns are shown in the following pages: * Object Storage * Public Buckets

* Improved Launchpad descriptions * Improving Malicious IP Connection Signature * Adding UTC Labels across DataDefender for date specificity * UI text and tooltip improvements #### Fixed * Adding more input validation for the Registration page * UI Fixes # Contact Us & Support Our friendly support team is here to help. Learn what information to share and when you can expect a response. ## How can I reach out to your team for support? **Email** The best way to get ahold of our team is by writing . **Weekly Office Hours** Join us during our weekly office hours every Wednesday at 12pm ET - [Join the Office Hours Meeting](https://meet.google.com/iig-choh-bii) ## What information should I share? To help us help you as efficiently as possible, please be sure to send us all relevant details: 1. Please describe the steps that you are taking, what happens when you take those steps, and what you expected to happen instead. 2. If you are running into an error message, please pass along the error message in full. 3. Can you send us a screenshot to show us what you're seeing? Or, can you send us a short video to show us the steps that you are taking? These are extremely helpful! ## When will I get a response? Our team is online Monday-Friday and we aim to respond to every message within 1 business day. ## Where can I direct sales related questions? If you would like to discuss pricing or have a Total Cost of Ownership conversation please reach out to our team here: [cloudstoragesecurity.com/contact](https://cloudstoragesecurity.com/contact) ## What if I'm interested in becoming a Cloud Storage Security Partner? If you are a software vendor or service provider and would like to integrate or offer DataDefender as part of your service, please reach out to our team here: [cloudstoragesecurity.com/contact](https://cloudstoragesecurity.com/contact)