Overview
When the data forensics or incident response team isolates potentially compromised data, the data is collected in a forensically sound way and uploaded into Canopy’s system. Canopy’s data mining software processes it by removing duplicates, filtering out irrelevant data, extracting text and metadata from various file formats, and classifying data that may contain personal information. This step reduces the volume of data requiring assessment, increasing efficiency and reducing cost.
There are eight activities of the Processing Phase:
Uploading Data
File Types
Structured Data
DICOM Files
Virus & Symlink Scan
Fields
Classification
Custom Detection Rules
These are the workflows the Canopy App provides to support the Processing Phase:
| Activity Name | Description | How Tos |
|---|---|---|
| Uploading Data | Upload data into Canopy using S3 presigned URLs, Azure SAS, web browser, Citrix Sharefile, or Microsoft Office 365. | Upload from AWS S3 · Upload from Azure SAS · Upload via web browser · Upload via Citrix Sharefile · Upload from Office 365 |
| File Types | Reference for supported upload containers, supported file types, unsupported files, skipped files, and file type filtering. | Upload container files · Supported files · Unsupported files · Skipped files · File types filtering |
| Structured Data | Process structured data including databases, binary data, and text files for entity mapping. | Database files · Binary data · Text files |
| DICOM Files | Process and access metadata from DICOM medical imaging files for PII detection. | Configure PII detection · Search for DICOM files · Detection fields |
| Virus & Symlink Scan | Scan uploaded files for malware and symbolic links during processing. | Enable virus scan in template · Enable virus scan during processing · Handle infected files · Virus scan billing |
| Fields | Reference for all fields automatically extracted and mapped during processing. | View fields reference |
| Classification | Image classification, signature detection, language identification, and element classification applied during processing. | Search by image classification · Search for signatures · Language identification · Element classification |
| Custom Detection Rules | Create and upload custom PII detection rules using Python regex to augment Canopy’s existing detection. | Download sample rules · Define your rules · Upload and process rules · Re-run PII with custom detection |
| Password Bank | Manage passwords to decrypt encrypted files and retry processing failed files. | Upload passwords · Retry failed files |