Configuring Malware Policy for Google Drive

Malware Policy

By default, the Google Drive malware policy scans the uploaded files for malicious content.

Supported Actions

Google Drive malware policy supports these actions:

  • Quarantine malware-infected files.

  • Alert owner: Sends an email notification to the user who uploaded a file that contains malicious content.

  • Alert admin(s): Sends an email notification to the admin(s) about the malicious files.

Configuring Malware Policy

To configure Malware policy:

  1. Click Policy on the left panel of the Email Security Administrator Portal.
  2. Click Add a New Policy Rule.
  3. From the Choose SaaS drop-down list, select Google Drive.
  4. From the Choose Security drop-down list, select Malware and click Next.
  5. Select the desired protection mode (Detect and Remediate or Detect).

    If required, you can change the Rule Name.

  6. Choose Scope for the policy.

    • To apply the policy to specific users or groups, select the users and groups and click Add to Selected.

    • To apply the policy to all users and groups in your organization, enable All Users and Groups checkbox.

    • To exclude specific users or groups from the policy, select the users/groups and click Add to Excluded.

  7. Under Blades, select the threat detection blades required for the policy.
    Note:

    To select all the blades available for malware detection, enable All running threat detection blades checkbox.

  8. Under Suspected malware workflow (Attachment) in Workflows, select the workflow required for the policy.

    • Quarantine. User is alerted and allowed to restore

    • Quarantine. User is alerted, allowed to request a restore (admin must approve)

    • Quarantine. User is not alerted (admin can restore)

    • Do nothing

    Note:

    The Workflows are available only when Detect and Remediate protection mode is enabled.

  9. To quarantine malware-infected files, enable the Quarantine drive files checkbox.
    Note:

    This option will be available only in Detect and Remediate protection mode.

  10. Configure Alerts for the policy.
    1. To send email alerts to the file owner of malware, enable the Alert file owner of malware checkbox.
    2. To send email alerts to admin(s) about malware, enable the Alert admin(s) checkbox.

    Note:

    • Even when the alerts are enabled here in the policy, the administrator only receives email alerts for security events when Receive Alerts role is enabled in the Specific Service Role. For more details about managing roles and permissions in the Check Point Portal, refer to Global Settings > Users in Check Point Portal Administration Guide.

    • To customize the email alert templates, click on the gear icon to the right of the alert.

  11. Click Save and Apply.