Whitelist cloud apps based on combinations of fields

Motivation

So you want to whitelist network tools, but only for your network administrators?  Something like

email = 'admin1@company.com' OR 'admin2@company.com'

AND

malicious_file_name = 'PuTTy'

1. Select an app result of the type you would like to whitelist, and select Add to Whitelist as usual

2. Click Custom in the bottom left

3. A list of all attribute paths will populate, each with a text field. Fill in the desired values.

   

   1. Options are OR if within the same box. Each box is then combined with an AND.

   2. For example, in the picture above, you will whitelist items that match all of the following

      1. Result = "success" AND

      2. description = "Update user" AND

      3. principalName = "adm@cm.com" or "az@cm.com"

4. Select Apply to existing if desired, and click Add