Policies
Policies are the core of Keep Aware's browser security enforcement. They allow security teams to detect, respond to, and report on browser activities across the organization.
What are policies?
A policy is a flexible configuration that defines what browser activity to detect, how to respond, and who it applies to. Policies replace the legacy "Patterns" system with enhanced capabilities including dedicated categories, browser controls, and more granular targeting.
Policy categories
Policies are organized into five categories, each designed for specific security use cases:
| Category | Description |
|---|---|
| Threat Protection | Detect and block phishing, malware, and malicious web activity |
| Data Loss Prevention | Prevent sensitive data from being uploaded, copied, or shared |
| Extension Management | Monitor and control browser extension installations and behavior |
| Acceptable Use | Enforce browsing policies and access controls |
| Browser Control | Apply browser-level controls like HTTPS enforcement and permission blocking |
Key use cases
-
Phishing and threat protection — Detect phishing campaigns, credential theft attempts, and malicious web activity in real-time. Subscribe to the Best Practices Feed for continuously updated threat detection.
-
Data loss prevention — Prevent users from uploading sensitive files, pasting credentials into untrusted sites, or copying confidential data.
-
Access controls — Block access to restricted sites, enforce acceptable use policies, and require justification for accessing certain resources.
-
Extension security — Monitor browser extensions, block risky installations, and enforce extension allowlists.
-
Browser hardening — Enforce HTTPS, block dangerous permissions, and apply session controls.
Components of a policy
-
Detection — The specific activity and conditions that trigger the policy. Uses a query-based system to match browser events.
-
Safeguard — The user-facing response when a policy is triggered. Can range from a subtle tooltip to a full page block.
-
Browser controls — Technical controls applied to the browser, such as HTTPS enforcement or permission blocking.
-
Profiles — Which users, groups, or browser profiles the policy applies to.
-
Integrations — Where to send alerts and events when the policy triggers (SIEM, Slack, email, etc.).
-
Exceptions — Specific users, devices, or locations excluded from the policy.
Getting started
The fastest way to get started is to subscribe a profile to the Best Practices Feed, which includes pre-configured policies maintained by Keep Aware. You can also create custom policies from templates or from scratch.
Policy introduction
A policy is a highly flexible data model that allows IT security teams to create and enforce security controls across the organization. Policies can detect browser activities, apply user-facing safeguards, trigger integrations, and report on events. The most common use cases for policies are:
Creating policies
This guide walks through creating a new policy in the Keep Aware console, from initial setup to activation.
Detection configuration
Detection settings define what browser activity triggers a policy. At minimum, every policy requires an Activity type and a Detection Query.
Safeguard configuration
Safeguards are the user-facing responses when a policy is triggered. They range from subtle notifications to full page blocks, providing real-time security awareness and enforcement.
Browser controls
Browser controls are technical enforcement mechanisms that operate at the browser level. Unlike safeguards that respond to specific activities, browser controls apply persistent configurations to the browser itself.
Policy templates
Policy templates are pre-configured policies that detect common security scenarios. Templates provide a starting point that you can customize for your organization.
Assignments and exceptions
Policies are applied through assignments and can be exempted through exceptions. This guide covers how to control which users, groups, and browsers a policy affects.
Integrations and actions
Policies can trigger actions when they match browser activity. This includes sending events to integrations, creating threats, collecting evidence, and including events in reports.
Best Practices Feed
The Best Practices Feed is a curated collection of policies maintained by Keep Aware. Subscribing a profile to this feed automatically applies high-fidelity, regularly updated policies that protect against common threats.
Policy locks
Policy locks let manager tenants control which parts of a distributed policy their child tenants can change. When you lock a section of a policy you distribute, child tenants can still see the configuration but can't edit it, and the locked section is overwritten with your version on every distribution push.