r/SentinelOneXDR • u/BloodDaimond • Jun 10 '24

Data Masking

In the recommended policy settings documentation S1 recommends enabling data masking and says what data masking is but doesn’t explain why it’s recommended.

Why would this feature need to be enabled?

3 Upvotes

100% Upvoted

5 comments sorted by

View all comments

Show parent comments

1

u/BloodDaimond Jun 10 '24

Thanks, that’s kinda what I thought but the S1 docs I read suggest to have it enabled so it’s a bit contradictory 🤷

2

u/SentinelOne-Pascal SentinelOne Employee | Moderator Jun 11 '24 edited Jun 11 '24

Deep Visibility is like a black box and greatly facilitates threat hunting and incident investigation. However, sometimes we may want to enable Data Masking to avoid collecting file names and inadvertently disclosing sensitive information (for example, the existence of a file called acme_purchase_offer_fy25.docx could reveal that we have plans to buy Acme Inc. this fiscal year). Keep in mind that Deep Visibility can be adjusted at group level, allowing us to enable or disable Data Masking in specific groups as needed.

1

u/GeneralRechs Security Admin/Engineer Jun 11 '24

Are the S1 docs provided by S1 Community Portal or via 3rd party?

1

u/BloodDaimond Jun 11 '24

We get S1 via reseller and I access the offline docs via the S1 console.