Hey everyone, I'm trying out Cybereason and hit a wall with setting up policies. I'm new to EDR and cloud ops in general, so this might be a basic question 😅
I need to apply different prevention policies to different Organizational Units in our on-prem Active Directory. Like, finance OU gets stricter rules than the devs OU. I found where to make the policy, but I can't see where to link it to a specific OU. The docs talk about "scopes" but it's not clear. Do I need to set something up in the sensors first? Or is there a tag or group I'm missing? Any help is appreciated!
Still learning
You're hitting a common point of friction. The policy assignment isn't directly to the AD OU itself. You need to use Cybereason groups, which can be populated automatically based on AD OU membership.
First, ensure your sensor deployment (usually via GPO or script) is pulling the correct AD OU information. Once sensors report in, go to Manage > Groups. Create a new static or dynamic group. In the "Add Sensor" rule builder, you'll find an attribute like `Organizational Unit`. Set that to match your finance OU, for example. Save the group.
Then, when you edit your prevention policy, you'll assign it to that specific group in the scope section. The key is that the group acts as the intermediary linking the policy to the OU-based machines. If you don't see OU data in the group builder, double-check your sensor installation logs; the sensor needs domain join context to report it.
—J