Ticket types for User Data Governance

Coro generates tickets relating to data governance when it identifies security incidents involving the following sensitive data types:

• Privacy-sensitive data tickets
• Suspicious exposure of certificate
• Suspicious exposure of critical data
• Suspicious exposure of file type
• Suspicious exposure of password
• Suspicious exposure of source code

Privacy-sensitive data tickets

Coro detects when a user shares or emails information that includes sensitive data. When an admin user configures monitoring settings, Coro flags the data and creates one of the following user data governance tickets to alert them, based on the sensitive data types detected:

• Credit Card Data
• Health Data
• Non-Public Data
• Personal Data

To learn more about what information constitutes these sensitive data types, see Regulatory sensitive information types.

Data compliance officers might need to review privacy-sensitive tickets to meet regulatory standards, such as GDPR and HIPAA. Coro classifies these tickets as suggested for review and automatically closes them after two weeks.

Privacy-sensitive data tickets include the following actions:

For further information on how Coro protects an organization's user data, see Introducing User Data Governance.

For further information on data governance ticket management, see Ticket management.

Suspicious exposure of certificate

Coro identified a user account that was involved in a potential data exposure event with monitored security certificates (files with a .crt or .pem extension used to establish a secure connection between a client and a server). This occurs where monitoring for Certificates was enabled (see Monitoring). Coro classifies tickets as suggested for review and automatically closes the tickets after the review period of two weeks, or one week for Coro SOC clients.

Suspicious exposure of critical data

Coro identified a user account that was involved in a potential data exposure event with monitored critical data (specific defined keywords in email and shared file content). This occurs where monitoring for Specific keywords was enabled (see Monitoring). Tickets are classified as suggested for review and are automatically closed after the review period of two weeks.

Suspicious exposure of file type

Coro identified a user account that was involved in a potential data exposure event with monitored file types (specific defined file types added as email attachements and in shared drive content). This occurs where monitoring for Specific file types was enabled (see Monitoring). Tickets are classified as suggested for review and are automatically closed after the review period of two weeks.

Suspicious exposure of password

Coro identified a user account that was involved in a potential data exposure event that included passwords. This occurs where monitoring for Passwords was enabled (see Monitoring). Tickets are classified as suggested for review and are automatically closed after the review period of two weeks.

Suspicious exposure of source code

Coro identified a user account that was involved in a potential data exposure event that included monitored source code files (files with a known code or script extension such as .md, .yaml, .sh). This occurs where monitoring for Source code was enabled (see Monitoring). Tickets are classified as suggested for review and are automatically closed after the review period of two weeks.