Add Cloud Content Sources

The initial phase of configuring Secure and Govern involves incorporating one or more Content Sources for monitoring purposes, enhancing the security of the content with each additional source. Cloud and On-premises Content Sources can be integrated, ensuring comprehensive monitoring regardless of data location. This article provides guidance on adding content sources to Egnyte Secure and Govern.

Supported Cloud Content Sources

• Egnyte
• Microsoft
• Amazon S3
• Azure
• Google Cloud
• Google Drive
• Dropbox
• Box

Egnyte

1. Access Secure and Govern from the left app picker menu.
   
2. From the home page, select Settings, click Add Cloud Source and select Egnyte to begin.
   
3. Click Next.
   
   

   To add an Egnyte source, it's necessary to have Admin credentials in Egnyte Collaborate.

4. Enter the Egnyte domain name and click Next.
   
5. Authenticate as an Admin User in the Egnyte login window that pops up. Egnyte Secure & Govern will access the Egnyte domain as this user. Click Continue in the popup window after authenticating.
   
   

   We recommend creating a dedicated Admin Service Account within the domain for Egnyte Secure & Govern. Using a distinct account will ensure that access by Egnyte Secure & Govern is segregated within audit reports for the domain.

6. Click here for steps to create an Admin Service Account. When creating the Admin Service Account, remember to add  Secure & Govern to the username as it will help to easily separate actions taken via Secure & Govern.
7. Specify a source name or use the default option and click Next.

8. Users can select any folder paths they wish to exclude within the source from scanning. If a path needs exclusion, they can click on the corresponding checkbox. The checkmark will then transform into a red X, signifying the exclusion of the path and all sub-folders. Under these paths, Egnyte Secure & Govern will refrain from accessing any folders or content. Finally, users can click Finish to save their selection.

   By excluding folder paths, issues or sensitive content within these paths won't be detected. For comprehensive coverage, it's recommended not to exclude paths. However, Admin can modify this configuration at any time after adding the source.

   
   
9. Newly added source will appear in the Cloud Content Sources list below.
   

The access control issue scan starts right away. As issues are discovered, they'll show up in the Issues tab. Once the initial scan finishes, Admin will get an email summary of all found issues. After that, the source will be constantly monitored for new and updated issues.

OneDrive for Business and SharePoint Online

1. From the home page, select Settings, click Add Cloud Source, and select Microsoft.
   
2. Click Next.
   
   
   
3. Specify a source name or use the default option and click Next.
   
   

   User must have Global Administrator credentials with OneDrive for Business to add it as a source.

4. Enter OneDrive or Microsoft Office 365 login credentials and click Next.
   
   

   If the user is already logged into OneDrive or Microsoft Office 365, select the appropriate account from the list and enter the password.

5. Accept the Permissions Requested.
   
   
6. Select whether or not to configure Microsoft Exchange, then click Next.
   
   
7. Select the groups for Secure & Govern to scan and click Save.
   
   
8. Select the SharePoint Online sites for Secure & Govern to scan, then click Save.
   
   
9. Users can modify the Groups and Sites configuration at any time via the Content Source settings.
   
   
10. Choose whether to configure Permissions Management or configure it later and then click Next.
    
    

    Permissions Management needs to be configured to view permissions and detect new issues in Secure & Govern

11. Newly added source will appear in the Cloud Content Sources list.

Exchange Online

Egnyte Secure & Govern allows the classification of content from emails and attachments within the Exchange Online server. Users can set up access to Exchange Online by adding Microsoft/Office 365 as a source and completing an additional optional step.

Click here for more details on adding Exchange Online as a content source.

Google Drive and Gmail

Click here for more details on adding Google Drive and Gmail as content sources.

Microsoft Azure Storage

1. From the home page, select Settings, click Add Cloud Source and select Microsoft Azure Storage.
   
   
2. Click on Access Key and enter the Azure Account Name and Account Key. If the necessary details are unavailable, refer to this article to view the account access key. Then proceed by clicking on Register.
   
3. Click on Allow Access for Egnyte to access the content of Azure Storage.
4. Newly added source will appear in the Cloud Content Sources list.

Microsoft Azure Files

1. From the home page, select Settings, click Add Cloud Source and select Microsoft Azure Files.
   
2. Click on Access Key and enter the Azure Account Name and Account Key. If the necessary details are unavailable, refer to this article to view the account access key. Then proceed by clicking on Register.
   
3. Click on Allow Access for Egnyte to access the content of Azure Storage.
   
4. Newly added source will appear in the Cloud Content Sources list.

Amazon S3 Storage

1. Establish permissions for the S3 identity or user intended to establish the connection between Egnyte and Amazon S3. These permissions can apply to all buckets or specific ones intended to be linked with Egnyte, but the permissions must match.
   • Permission list:
     • On the bucket level - s3:ListBucket, s3:GetBucketLocation, s3:ListObjects
       Note: the s3.ListObjects permission has been deprecated by AWS but can still be defined via the JSON view. It should be added under the "action" section along with the other 2 permissions on the bucket level
     • On the bucket object level - s3:GetObject
     • For all buckets - s3.ListAllMyBuckets
       

       Resource definition format:

       1. "Resource": "arn:aws:s3:::BUCKET_NAME" - permission for bucket (alternatively * instead of BUCKET_NAME)
       2. "Resource": "arn:aws:s3:::BUCKET_NAME/*" - permission for bucket objects (alternatively */* instead of BUCKET_NAME/*)
       3. "Resource": "*" - all resources
   • Guide for AWS permissions:
     https://docs.aws.amazon.com/config/latest/developerguide/s3-bucket-policy.html#required-permissions-in-another-account
   • Example of granting permissions:
     https://docs.aws.amazon.com/AmazonS3/latest/userguide/example-walkthroughs-managing-access-example1.html#grant-permissions-to-user-in-your-account-step1
2. From the home page, select Settings, click Add Cloud Source, and select Amazon S3 Storage.
   
   
3. Enter the desired label for the source and details like S3 Identity (Access Key ID) and S3 Secret (Secret Access Key). If an Access Key ID or Secret Access Key is not already available, refer to this article to create one.
   
   
4. Click on Allow Access for Egnyte to access the content of Amazon S3 storage.
   
   
   
5. Newly added source will appear in the Cloud Content Sources list.

Dropbox Storage

1. From the home page, select Settings, click Add Cloud Source, and select Dropbox Storage.
   
   
2. Enter the desired label for the source and click on Register.
   
   
3. Click on Allow Access for the Dropbox Connector to access Egnyte.
   
   
4. Enter the email address and password to the Dropbox Admin account.
   
   
   
5. Newly added source will appear in the Cloud Content Sources list.

Box Storage

Create a Box Application

1. Log into the Box Developer console: https://app.box.com/developers/console
2. Select My Apps and then Create New App.
   
3. Select Custom App.
   
4. Fill in the details in step 1 of 2:
   • App Name - can be anything but should identify what the app is for (i.e. Egnyte App).
   • Description - optional.
   • Purpose - select Automation.
   • Who - select Customer.
   
5. Select User Authentication in step 2 of 2.
   
6. On the Configuration page for the app that pops up after the previous step, copy the Client ID and Client Secret. These will be needed to connect to Engyte.
   
7. Fill in the Redirect URI.  The URI should be (depending on the Egnyte region):
   1. US: https://usc1.egnyteprotect.com/connectors/box-connector/sources/connect 
   2. Europe: https://euw1.egnyteprotect.com/connectors/box-connector/sources/connect 
   
   
8. Mark permission scopes:
   1. Permissions required are:
      1. Read all files and folders stored in Box.
      2. Write all files and folders stored in Box.
      3. Manage users.
      4. Manage groups.
      5. Manage enterprise properties.
      6. In addition to the above, a special permission is needed:
         1. admin_on_behalf_of
            Note: This has to be requested via contacting Box Support.
   
   
9. Save changes.

Register the Box source in Egnyte Secure & Govern

1. Navigate to Egnyte Secure & Govern -> Settings. The user will be taken to the Cloud Sources page.
2. Select Add Cloud Source and then select Box from the list of source types.
3. Enter an App name (this will be what the source is called in the S&G UI).
4. Fill in the Redirect URI (the same URI that was used in the Box application configuration).
5. Fill in the Client ID and Client Secret that was saved from the Box application page.
   
6. When redirected to the Box OAuth grant request, click the Grant access to Box button.
      
7. The success page should confirm registration. The list of sources on the Content Sources page should now include the Box source.
   
   

Box FAQ:

Is it possible to use the same client ID and client secret to register another Box source? 

Yes, but if that is done all the requests with this client ID will be counted by Box against the same single quota for the number of API requests, and the quota will be depleted sooner consequently.

How does the Egnyte connection to Box affect my Box account?

Egnyte uses the Box API to retrieve files and information from the Box source and those API calls will count against the Box quota. The number of API calls that are made can vary widely depending on the amount of data in the Box source and the structure of the data (i.e. many top-level folders or few top-level folders). 

See https://www.box.com/pricing for more information on API costs and  https://developer.box.com/guides/api-calls/permissions-and-errors/rate-limits/ for API rate limitations. For any other questions, contact your Box account manager.

 

Add Additional Sources

Click Add Cloud Source again and follow the related steps to add additional Cloud Sources. If adding on-premise SharePoint or Windows File Server sources is desired, please refer to this article or reach out to Egnyte Support for assistance.