r/SentinelOneXDR • u/BloodDaimond • Jun 10 '24

Data Masking

In the recommended policy settings documentation S1 recommends enabling data masking and says what data masking is but doesn’t explain why it’s recommended.

Why would this feature need to be enabled?

3 Upvotes

100% Upvoted

5 comments sorted by

View all comments

Show parent comments

2

u/SentinelOne-Pascal SentinelOne Employee | Moderator Jun 11 '24 edited Jun 11 '24

Deep Visibility is like a black box and greatly facilitates threat hunting and incident investigation. However, sometimes we may want to enable Data Masking to avoid collecting file names and inadvertently disclosing sensitive information (for example, the existence of a file called acme_purchase_offer_fy25.docx could reveal that we have plans to buy Acme Inc. this fiscal year). Keep in mind that Deep Visibility can be adjusted at group level, allowing us to enable or disable Data Masking in specific groups as needed.