How to use information protection labels in Cortex Data Security

Overview

Information protection labels are digital tags that help your organization classify and secure sensitive data. They identify how sensitive a piece of information is, whether it's a document or an email. Once applied, these labels can automatically trigger protective measures like encryption to control who can access the file, or restrictions on who can edit or share it.

Ultimately, these labels are vital for enforcing your data policies and significantly cutting down the risk of data breaches. They ensure sensitive information is managed correctly throughout its entire journey, from when it's created to when it's no longer needed.

Each sensitivity label within your organization is assigned a unique GUID. This ensures consistent policy enforcement regardless of where the data resides or moves.

Once you have integrated Microsoft 365 with Cortex Data Security, after scanning you will be able to identify the files having information protection labels and view the specific GUIDs for each one.

For information about integrating Microsoft 365 (Posture), see How to onboard Microsoft 365.

How Cortex Data Security locates information protection labels

The Cortex Data Security scanner runs on your files and extracts the information protection labels from them during the classification process. This extraction is supported across all platforms and asset types, both file-based and unstructured.

Label translation

To enable the translation of Microsoft IDs to label names, connect to the Microsoft 365 integration.

Example

GUID	Translated Label
6b29fc40-ca47-1067-b31d-00dd010662da	Sensitive-Internal

Find the labels in the Cortex Data Security Security Command Center

1. In the navigation pane on the left, click Modules → Data Security.
2. Under Objects Inventory, click Files.
3. On the Files Inventory screen, click Show filter panel to open the filter panel and then do the following:

   1. In the Select field list, select Has Information Protection Labels.
   2. In the next list to the right, select the equals sign (=).
   3. In the next field to the right, select Yes.
   4. Click anywhere in the screen outside the filter panel area.

      Now only files with information protection labels are displayed. In the Information Protection Labels column, the IDs for these labels appear.

Note: Only If you have connected a Microsoft 365 instance to Cortex Data Security, the information protection labels appear. See How to onboard Microsoft 365.