Create an Exception Workflow

Keep Aware can be used to manage access requests for certain browser-based and web activities. Where most Keep Aware implementations will block threats and certain organizational risk, security teams can setup an exception workflow or access request workflow to allow users to request access to certain sites.

Getting Started

To create an exception workflow, there are a few considerations to outline with your IT security or help-desk team. You must consider for what activities will user be able to request access or exceptions, where the access requests should be sent, and how your team will respond to the access requests.

Allowing Users to Request Access

Access requests are enabled on a safeguard, which you then attach to a policy. On the Safeguards page, create or open a safeguard and enable the Request Access button in its action buttons. In a policy's Safeguard section, select that safeguard to attach it. A policy with no safeguard has no user impact, so it needs no request access option. Most teams add the request access button only to safeguards that restrict user activity.

Creating a Policy to Forward Access Requests

When a user hits the "Request Access" button on a safeguard, it will create a request event in your console. These events, like any activity, can be searched across. To view any open access requests, you can use the pre-built request filter, by clicking on the filter button on the Events page. To learn more about how to respond to these events, visit Manual Exceptions.

To manage access requests in another system, you can forward these events and information about the request to any alerting integration. To forward request events, create a policy that detects them: click Create Policy on the Policies page and select the Forward Access Requests starter template. This policy generally matches request events across any location or domain, so a single forwarding policy captures every access request regardless of which blocking policy prompted it. You can also create a policy from scratch and write the detection logic to target any request event.

Assign the policy to a profile in the Assignments section. Then, in the policy's Integrations section, check the box next to any alerting integration to start forwarding those events to it. If no integrations appear, create one in the next step.

Adding an Integration to Access Requests

Once the policy is created, you can select a certain event forwarding integration to send any access request to your IT team via email, slack, teams or other workflow solutions.

Once an integration is creating, you can change the body of the integration to reflect the event details that you want to include in your access request. As a starting point, use the template below:

A user has submitted an access request through Keep Aware

Type: {{type}}
User: {{user.label}}

Location/Hostname: {{location}}
Lists: {{lists}}

Request Event:
https://console.awarefilter.com/explore/events?query=_id:%22{{id}}%22

Restriction Event:
https://console.awarefilter.com/explore/events?query=_id:%22{{session.prev_hit}}%22

Other properties can included in your event by encapsulating the property in double curly bracket characters. For example, the user's label would be {{user.label}} in the integration body.

Some integrations such as Email and Jira Service Management support the use of HTML. For example, the above references to request and restriction event links could be:

Request Event:
<a href=https://console.awarefilter.com/explore/events?query=_id:%22{{id}}%22>Request for {{location_full}}</a>

Restriction Event:
<a href=https://console.awarefilter.com/explore/events?query=_id:%22{{session.prev_hit}}%22>Restricted {{type}} for {{location_full}}</a>

Frequently Asked Questions

Question	Answer
What other systems can I send access requests to?	The most common alerting integrations used for this workflow are Email Alerts, Slack, Teams, and Jira Service Management. Alerting integrations also have webhook support.