Creating policies

This guide walks through creating a new policy in the Keep Aware console, from initial setup to activation.

Creating a new policy

To create a new policy:

1. Navigate to Policies in the console
2. Click Create policy
3. Choose your starting point:
   • Create from scratch — Start with a blank policy
   • Review templates — Browse pre-configured policy templates

Create policy modal

When creating a policy from scratch, you'll first complete a short form:

Name

Give your policy a descriptive name. This appears in the console, logs, and reports. The name is also used to auto-generate the policy's label (snake_case version used for searching).

Examples:

• "Block Personal Email Uploads"
• "Detect Microsoft Credential Phishing"
• "Restrict Social Media Access"

Description

Optional internal notes about the policy's purpose, configuration details, or use case. This is only visible in the console.

Category

Select the category that best fits the policy's purpose:

Category	When to Use
Threat Protection	Phishing detection, malware blocking, credential theft prevention
Data Loss Prevention	Sensitive data monitoring, upload restrictions, copy/paste controls
Extension Management	Extension installation monitoring, risky extension blocking
Acceptable Use	Site access controls, browsing policy enforcement
Browser Control	HTTPS enforcement, permission blocking, session controls

The category affects which configuration options are available in the policy editor.

After completing the form, click Create policy to open the full policy editor.

Policy editor overview

The policy editor is organized into expandable sections. Required sections must be configured before the policy can be saved.

Detection section (required)

Configure what browser activity triggers this policy:

1. Activity Types — Select one or more activity types to detect (page visit, upload, download, input, etc.)

2. Detection Query — Define the specific conditions using the query builder or raw query syntax

3. Activity Query — Optional additional filtering for input-related activities

See Detection Configuration for detailed guidance.

Safeguard section

Configure the user-facing response when the policy triggers:

1. Safeguard Selection — Choose from default safeguards or create a custom one
2. Safeguard Type — Block, pause, notify, or reinforce
3. Display Style — Modal, card, tooltip, redirect, or watermark

Leave as "None" if the policy should only log/report without user notification.

See Safeguard Configuration for detailed guidance.

Browser controls section

Available for Browser Control category policies. Configure technical controls:

• Enforce HTTPS
• Redact copy/paste
• Block permissions
• Session controls
• Credential reuse prevention

See Browser Controls for detailed guidance.

Assignments section

Assign the policy to one or more profiles. A policy only takes effect when assigned to at least one profile.

Include/Exclude Logic:

• Include — Profiles, groups, or users the policy applies to
• Exclude — Profiles, groups, or users exempted from the policy

See Assignments and Exceptions for detailed guidance.

Integrations section

Configure where to send events when the policy triggers:

• Forward to Integrations — Send events to SIEM, Slack, email, etc.
• Evidence Collection — Capture screenshots or page content (S3/GCS)
• Reporting — Include events in reports and dashboards
• Create Threat — Generate a threat investigation

See Integrations and Actions for detailed guidance.

Exceptions section

View and manage exceptions for this policy. Exceptions temporarily or permanently exempt specific:

• Users
• Devices
• Locations (domains/URLs)
• Profiles

See Assignments and Exceptions for detailed guidance.

Advanced settings

Additional configuration options:

• Priority — Evaluation order (1-5, higher = evaluated first)
• Severity — Risk level for reporting (1-5, higher = more severe)
• Cooldown — Minimum seconds between repeated triggers
• Suppress — Prevent lower priority policies from triggering
• MITRE ATT&CK — Map to specific tactics and techniques

Saving and activating

Once configured, click Save to create the policy.

Policy Activation:

• A policy is active when it is assigned to at least one profile
• A policy with no profile assignments is saved but inactive
• You can test policies by assigning to a test profile before broader rollout

Duplicating policies

To create a variation of an existing policy:

1. Open the policy you want to duplicate
2. Click the More options menu (⋮)
3. Select Duplicate policy
4. Modify the duplicated policy as needed
5. Save with a new name

Best practices

1. Start with templates — Use policy templates for common use cases, then customize as needed

2. Test before rollout — Assign new policies to a test profile first to validate behavior

3. Use descriptive names — Make policy names clear and searchable

4. Set appropriate priority — Higher priority policies should handle more critical threats

5. Configure safeguards thoughtfully — Match the safeguard severity to the actual risk

6. Document your policies — Use the description field to explain the policy's purpose and any special considerations