Mapping incident and digest templates in Workflow Automation is one of the tasks for configuring Workflow Automation. Admins with access to Workflow Automation must configure the template mappings. Incident template mappings determine which notification and survey templates Workflow Automation uses when it generates the notifications for the different notification types (end user notification and escalation). The digest template mapping determines which templates Workflow Automation uses when it generates the digest notifications for your organization.

Workflow Automation provides a default source action for each source Data Loss Prevention (DLP) type (Inline, Email, Endpoint, and SaaS Security). These default actions are mapped to the default notification and survey templates that Workflow Automation provides. You can change the notification and survey templates associated with these default mappings, and you can delete them. If you want to add additional incident template mappings associated with the different source DLP type incidents and notification types, additional source actions are available.

On the Template Mappings page in the Workflow Automation Admin Portal, admins can:

• Add Incident Template Mappings

  Before adding incident template mappings, you must:

  • Add notification templates on the Notification Templates page of the Workflow Automation Admin Portal. To learn more, see Managing Notification Templates.
  • Add survey templates on the Survey Templates page of the Workflow Automation Admin Portal. To learn more, see Managing Survey Templates.

  To add an incident template mapping:

  1. Go to Setup > Template Mappings. The Template Mappings page appears, listing all the incident template mappings that have been mapped on the Incident tab.
  2. On the Incident tab, click Add More. The Add Template Mapping window appears.
  3. In the Add Template Mapping window:

  • Source DLP Type: From the drop-down menu, select the source DLP type. Source DLP types are Email, Endpoint, Inline, and SaaS Security.
  • Source Action: From the drop-down menu, select the source action for the incident. The available source actions depend on the source DLP type you select.
    • Inline
      • Default
      • Violates Compliance Category
      • Violates Compliance Category Archived To Mailbox
      • Violates Compliance Category Archive To Mailbox Failed
      • Allowed
      • Allowed And Archived To Mailbox
      • Allowed And Archived to Mailbox Failed

      Close
    • Endpoint
      • Default
      • Allow
      • Block
      • Confirm

      Close
    • SaaS Security
      • Default
      • Quarantine
      • Remove
      • Report Malware
      • Apply Email Tag
      • Report Incident
      • Make Sharing Read Only
      • Make External Sharing Read Only
      • Make Internal Sharing Read Only
      • Remove Public Link Sharing
      • Revoke Sharing Make Private
      • Remove External Sharing
      • Remove Internal Sharing
      • Remove All Collaborators
      • Remove Internal Link Sharing
      • Remove Discoverable
      • Notify End User
      • Apply Azure Information Protection Label
      • Apply BOX Tag
      • Move To Restricted Folder
      • Apply Email Label
      • Apply Google Drive Label
      • Remove External Collaborators
      • Quarantine To User Root Folder

      Close
    • Email
      • Default

      Close
  • Notification Type: From the drop-down menu, select the notification type. Notification types are End User Notification and Escalation.

  4. In the Template Family section:

  • Email: From the drop-down menu, select the email notification template family for the incident and notification type. All email notification template families that have been added on the Notification Templates page are available for selection.
  • Slack: From the drop-down menu, select the Slack notification template family for the incident and notification type. All Slack notification template families that have been added on the Notification Templates page are available for selection. This field is only available if you have integrated Workflow Automation with Slack.
  • Team: From the drop-down menu, select the Microsoft Teams notification template family for the incident and notification type. All Microsoft Teams notification template families that have been added on the Notification Templates page are available for selection. This field is only available if you have integrated Workflow Automation with Microsoft Teams.
  • Survey: From the drop-down menu, select the survey template family for the incident and notification type. All survey template families that have been added on the Survey Templates page are available for selection.

  See image.

  

  Close

  5. Click Add.

  Close
• Edit Incident Template Mappings

  To edit an incident template mapping:

  1. Go to Setup > Template Mappings. The Template Mappings page appears, listing all the incident template mappings that have been mapped on the Incident tab.
  2. (Optional) On the Incident tab, use the Search field to locate the template mapping that you want to edit.
  3. In the Action column next to the template mapping, click the Edit icon. The Edit Template Mapping window appears. You can only edit the template values in the Template Family section of the edit window.
  4. In the Edit Template Mapping window, change one or more of the following template family fields for an incident template mapping: Email, Slack, Team, and Survey. The Slack template family field is only available if you have integrated Workflow Automation with Slack, and the Teams template family field is only available if you have integrated Workflow Automation with Microsoft Teams.

  To delete an incident template mapping, on the Template Mapping page, click the Delete icon next to an incident template mapping.

  Close
• Add Digest Template Mappings

  Before you can add a digest template mapping, add user and DLP admin digest notification templates on the Notification Templates page of the Workflow Automation Admin Portal. To learn more, see Managing Notification Templates.

  To add a digest template mapping:

  1. Go to Setup > Template Mappings. The Template Mappings page appears, listing all the incident template mappings that have been mapped on the Incident tab.
  2. Click the Digest tab.
  3. On the Digest tab:

  • Under User:
    • From the Email Template drop-down menu, select a user digest email notification template family.
    • From the Slack Template drop-down menu, select a user digest Slack notification template family. The Slack Template field is only available if you have integrated Workflow Automation with Slack.
    • From the Teams Template drop-down menu, select a user digest Microsoft Teams notification template family. The Teams Template field is only available if you have integrated Workflow Automation with Microsoft Teams.
  • Under DLP Admin:
    • From the Email Template drop-down menu, select a DLP admin digest email notification template family.
    • From the Slack Template drop-down menu, select a DLP admin digest Slack notification template family. The Slack Template field is only available if you have integrated Workflow Automation with Slack.
    • From the Teams Template drop-down menu, select a DLP admin digest Microsoft Teams notification template family. The Teams Template field is only available if you have integrated Workflow Automation with Microsoft Teams.

  See image.

  

  Close

  Close
• Edit Digest Template Mappings

  To edit the digest template mapping:

  1. Go to Setup > Template Mappings. The Template Mappings page appears, listing all the incident template mappings that have been mapped on the Incident tab.
  2. Click the Digest tab.
  3. On the Digest tab, change any of the user or DLP admin template families that are displayed. Select another email notification template family from the Email Template drop-down menu, select another Slack notification template family from the Slack Template drop-down menu, or select another Microsoft Teams notification template family from the Teams Template drop-down menu. The Slack Template fields are only available if you have integrated Workflow Automation with Slack, and the Teams Template fields are only available if you have integrated Workflow Automation with Microsoft Teams.

  Close
• View Incident and Digest Template Mappings

  To view incident and digest template mappings:

  1. Go to Setup > Template Mappings. The Template Mappings page appears, listing all the incident template mappings that have been mapped on the Incident tab. For incident template mappings, you can view:

  • Source DLP Type: The type of DLP incident. Source DLP types are Email, Endpoint, Inline, and SaaS Security.
  • Notification Type: The type of notification for an incident. Notifications are End User Notification and Escalation.
  • Source Action: The source action for the incident notification. Source actions vary depending on the source DLP type.
  • Email Template: The email notification template family used for this type of incident notification.
  • Slack Template: The Slack notification template family used for this type of incident notification. The Slack Template field is only available if you have integrated Workflow Automation with Slack.
  • Teams Template: The Microsoft Teams notification template family used for this type of incident notification. The Teams Template field is only available if you have integrated Workflow Automation with Microsoft Teams.
  • Survey Template: The survey template family used for this type of incident notification.

  See image.

  

  Close

  2. Click the Digest tab. The Digest tab appears, listing the Email Template families, Slack Template families, and Teams Template families for the user and DLP admin digest notifications. The Slack Template family fields are only available if you have integrated Workflow Automation with Slack and the Teams Template family fields are only available if you have integrated Workflow Automation with Microsoft Teams.

  See image.

  

  Close

  Close