Cyberhaven

---
name: cyberhaven
description: "Expert agent for Cyberhaven DLP. Covers data lineage tracking, behavioral data flow analysis, real-time classification, browser extension and endpoint agent, generative AI data protection, insider risk detection, and SaaS platform configuration. WHEN: \"Cyberhaven\", \"data lineage\", \"data flow tracking\", \"behavioral DLP\", \"Cyberhaven agent\", \"generative AI DLP\", \"ChatGPT data leak\", \"Cyberhaven browser extension\"."
license: MIT
---

# Cyberhaven

This skill covers Cyberhaven's data lineage-based DLP platform, including data flow tracking, behavioral analysis, real-time classification, AI data protection, and policy configuration.

## How to Approach Tasks

1. **Identify the protection scenario** — generative AI leakage, insider risk, cloud exfiltration, endpoint controls, or data discovery
2. **Classify the request:**
   - **Data lineage questions** — Explain how Cyberhaven tracks data origin and movement
   - **Policy configuration** — Apply policy and rule guidance
   - **AI/GenAI protection** — Apply AI Hub and browser extension guidance
   - **Incident investigation** — Apply data lineage graph investigation guidance
   - **Integration** — SIEM, SOAR, or identity provider integration

## Platform Architecture

### Core Differentiator: Data Lineage

Traditional DLP inspects content at a point in time. Cyberhaven tracks data through its entire lifecycle.

```
Traditional DLP approach:
  File "report.xlsx" uploaded to Gmail
  → Inspect content → Does it match credit card pattern? → Block/Allow

Cyberhaven data lineage approach:
  File "random_name.xlsx" uploaded to Gmail
  → This file was created by exporting from Salesforce CRM at 9:14 AM
  → User downloaded it from internal SharePoint
  → Renamed to "random_name.xlsx"
  → Attempting to upload to personal Gmail
  → BLOCK — because origin is Salesforce CRM (sensitive source), regardless of current filename or content

Data lineage graph:
  Salesforce CRM export → random_name.xlsx → renamed_file.docx → uploaded to drive.google.com/personal
  └── Each arrow is a tracked transformation with timestamp, user, and application
```

### Architecture Components

```
Cyberhaven SaaS Platform
├── Data lineage graph database — stores provenance chains for all tracked data
├── Policy engine — evaluates lineage + content + behavioral context
├── Alert management — triage and investigation console
├── Analytics — data flow visualization, risk scoring
└── Integration APIs — SIEM, SOAR, identity providers

Endpoint Agent
├── OS-level agent (Windows, macOS)
├── Monitors all file operations, clipboard, process interactions
├── Tags data at creation with a lineage identifier
└── Tracks transformations: copy, modify, rename, save-as

Browser Extension
├── Chrome, Edge, Firefox
├── Monitors web uploads, form submissions, clipboard paste in browser
├── Enforces policies on cloud app interactions
├── Critical for: GenAI platforms (ChatGPT, Gemini, Copilot in browser)
└── Visibility into SaaS application data flows
```

### Data Classification Engine

Cyberhaven classifies data in real-time as it's accessed:

```
Classification triggers:
  File opened → classify content at access time
  File created → classify at write time
  Data copy (clipboard, screenshot) → classify the data fragment
  Web upload → classify before transmission

Classification methods:
  1. Content inspection (regex, keywords, ML classifiers)
  2. Data origin (where data came from — high-trust source = high sensitivity)
  3. Behavioral signals (unusual access time, unusual volume)
  4. Label inheritance (data copied from sensitive file inherits sensitivity)

Key differentiator: Origin-based classification
  → Data from Salesforce = sensitive (regardless of current content)
  → Data from AWS S3 bucket marked "production" = sensitive
  → Data from internal HR system = sensitive
  → Renames, content modifications do not break the lineage chain
```

## Policy Configuration

### Policy Framework

```
Policy
├── Trigger conditions:
│   ├── Data origin: came from [Salesforce, HR system, specific folder]
│   ├── Data content: contains [SIT, classifier match]
│   ├── Data label: classified as [Confidential, Restricted]
│   ├── Destination: going to [personal email, ChatGPT, USB, competitor domain]
│   ├── User context: [high-risk user, departing employee, specific role]
│   └── Behavioral: [unusual volume, unusual time, anomalous pattern]
│
└── Actions:
    ├── Block: Prevent the operation
    ├── Warn: Show user a notification; allow with acknowledgment
    ├── Justify: Require user business justification
    ├── Monitor: Log only (no user impact)
    └── Alert: Create security alert (+ optional SIEM/SOAR trigger)
```

### Common Policy Patterns

**Pattern 1: Protect CRM/ERP data from exfiltration**
```
Policy: Salesforce Data Exfiltration Prevention
Trigger:
  → Data origin: Salesforce
  → Destination: personal email domains, personal cloud storage, USB
Action: Block + Alert (High severity)

Why this works without content inspection:
  → User exports contacts from Salesforce as CSV
  → Renames file to "notes.csv"
  → Cyberhaven knows this data originated from Salesforce
  → Blocks upload to personal Gmail even though content "looks" like a harmless CSV
```

**Pattern 2: GenAI leak prevention**
```
Policy: GenAI Platform Data Protection
Trigger:
  → Destination: chatgpt.com, gemini.google.com, claude.ai, bard.google.com
  → Data classification: Confidential or Restricted (any of: origin-based OR content-based)
Action: Block sensitive data; Warn for unclassified data

User experience:
  → User copies text from confidential contract
  → Pastes into ChatGPT chat window
  → Extension detects: clipboard content has lineage from contract.pdf (sensitive source)
  → Shows warning: "This content appears to be from a confidential document.
                    Pasting to external AI services is not permitted."
  → User must dismiss without pasting (block action)
```

**Pattern 3: Insider risk — departing employee**
```
Policy: Departing Employee Enhanced Monitoring
Trigger:
  → User: in AD group "Offboarding-Watch"
  → Any data movement to: personal email, personal cloud, USB, competitor domains
Action: Block + Immediate Alert (Critical severity)

Integration: HR system → Cyberhaven API to add user to watch list when
  resignation accepted or termination initiated
```

**Pattern 4: Shadow IT prevention**
```
Policy: Unsanctioned App Upload Prevention
Trigger:
  → Destination: cloud apps NOT in approved list
  → Data origin OR content: any sensitive classification
Action: Block + Educate user (show list of approved alternatives)

Approved list examples:
  → company.sharepoint.com (approved)
  → box.com/company-domain (approved)
  → Personal Dropbox, Google Drive (not approved)
```

### Generative AI Protection

Cyberhaven's browser extension provides deep visibility into GenAI interactions.

**Platforms monitored:**
- ChatGPT (chat.openai.com)
- Google Gemini (gemini.google.com)
- Microsoft Copilot (copilot.microsoft.com)
- Anthropic Claude (claude.ai)
- Perplexity, Mistral, and other AI assistants
- Custom enterprise GenAI deployments (via URL configuration)

**What is inspected:**
```
Prompt inspection:
  → Text typed or pasted into AI chat interface
  → Files uploaded to AI platforms (for analysis)
  → Code pasted into coding assistants

Data lineage check on prompts:
  → Where did this text come from? (clipboard origin)
  → Was it copied from a sensitive document?
  → Is it a verbatim excerpt from a classified file?

Enforcement options:
  → Block: Prevent submission to AI (user cannot send)
  → Redact: Remove sensitive portions, allow rest to proceed
  → Warn: Notify user, allow them to reconsider
  → Monitor: Log prompt activity for audit/review
```

**AI activity reporting:**
- Which employees are using which AI tools
- Volume of data being submitted to AI platforms
- Risk-ranked users by sensitive data submission frequency
- GenAI usage trends over time

## Data Lineage Investigation

### Incident Investigation Workflow

When a DLP alert fires in Cyberhaven:

```
1. Open alert in Cyberhaven console
   → Alert details: user, destination, timestamp, classification

2. View data lineage graph
   → Visual graph showing the data's journey:
     [HR System download] → [spreadsheet.xlsx] → [renamed to report.csv]
     → [emailed to personal@gmail.com]

3. Understand full context
   → What was the original source? (HR System = sensitive origin)
   → What transformations occurred? (rename, copy, modification)
   → What is the destination? (external Gmail = potential leak)
   → Is this a known business process or anomalous?

4. Determine risk
   → First offense + low-risk destination → User education
   → Repeat offense + high-risk destination → Escalate to HR/Legal
   → Departing employee + bulk export → Escalate immediately

5. Response actions
   → Document in case management
   → Notify HR/Legal (if policy violation)
   → Revoke device access (if critical)
   → Legal hold if litigation relevant
```

### Lineage Graph: Technical Details

```
Each data object tracked by a lineage identifier (UUID)
  → Created when data is first observed on endpoint
  → Persists through: rename, copy, content modification, format conversion

Lineage breaks (new identifier assigned):
  → Data manually re-typed (not copied from existing data)
  → Data arrives from external source (new file download)
  → Screenshot OCR'd text (treated as new data, but linked to source)

Lineage chain depth:
  → Tracks N generations of copy/transformation
  → No practical limit on chain depth
  → Timeline view shows all transformations with timestamps
```

## Integration

### SIEM Integration

```
Splunk:
  → REST API pull or Syslog CEF push
  → Cyberhaven Splunk App available
  → Events: dlp_alert, policy_match, data_movement, lineage_event

Microsoft Sentinel:
  → Syslog CEF → Log Analytics workspace
  → Custom analytics rules for DLP alert correlation
  → Playbooks for automated response (block user in Entra ID on critical alert)

QRadar:
  → CEF Syslog format
  → DSM (Device Support Module) for Cyberhaven available
```

### Identity Provider Integration

```
Okta / Entra ID:
  → Pull user attributes (department, manager, employment status)
  → Enrich alerts with HR context
  → Trigger Okta workflow on critical DLP alert (suspend user session)
  → Import offboarding events to flag departing employees automatically

HR System Integration (Workday, BambooHR, etc.):
  → API integration to import termination/resignation data
  → Automatically add departing users to enhanced monitoring policy
  → Remove watch status after final departure date + N days
```

### SOAR / Response Automation

```
PAN Cortex XSOAR:
  → Ingest Cyberhaven alerts as XSOAR incidents
  → Automated playbook:
      If severity = Critical AND user = departing_employee:
        → Disable Entra ID account
        → Suspend Okta session
        → Create ServiceNow ticket
        → Notify CISO + HR

Splunk SOAR:
  → Similar webhook-based integration
  → Pre-built Cyberhaven playbook available on Splunk marketplace
```

## Deployment and Configuration

### Initial Setup

```
1. Deploy browser extension
   → Chrome/Edge: Deploy via enterprise policy (recommended) or manual
   → Policy: Intune / Google Workspace MDM / JAMF
   → Visibility into all browser-based activities

2. Deploy endpoint agent
   → Windows: MSI via SCCM/Intune
   → macOS: PKG via JAMF
   → Provides file system and application-level visibility

3. Connect data sources
   → Configure integrations: Salesforce, Google Drive, Box, Slack, etc.
   → Mark sources with sensitivity level (sets origin-based classification)

4. Deploy in monitor mode
   → 2-4 weeks of monitoring before enabling enforcement
   → Review data flow patterns; identify normal vs. anomalous

5. Create policies
   → Start with high-confidence scenarios (Salesforce → personal Gmail)
   → Gradually expand to broader data types and destinations

6. Enable enforcement
   → Pilot with security team or IT department first
   → Roll out in waves by department
```

### Tuning Recommendations

```
Reduce false positives:
  → Mark internal tools/services as approved destinations
  → Classify internal file shares as approved sources when sharing internally
  → Create exceptions for specific business processes (HR exports to benefits vendor)

Reduce false negatives:
  → Add all sensitive source systems to origin-based classification
  → Ensure browser extension deployed to all managed browsers
  → Enable API integrations for cloud apps (Box, Google Drive, Salesforce)

Performance:
  → Endpoint agent: minimal CPU overhead for typical users
  → Browser extension: ~5-15ms latency on web operations
  → Large file uploads: inspection adds latency proportional to file size
```

## Common Issues and Troubleshooting

**Data lineage not connecting properly:**
- Verify agent is deployed on all endpoints handling sensitive data
- Check if data passed through an unmanaged device (lineage breaks at unmanaged hop)
- Review whether application is on the supported application list for lineage tracking

**Browser extension not blocking AI uploads:**
- Verify extension is deployed and enabled in enterprise policy
- Check if user is on an unsupported browser (IE is not supported)
- Ensure extension permissions include clipboard access
- Review extension logs in developer tools: chrome://extensions/ → Cyberhaven → Background page

**High alert volume overwhelming team:**
- Review top destinations triggering alerts — likely unsanctioned but low-risk apps
- Add approved destinations for sanctioned tools
- Adjust monitor vs. block vs. alert thresholds
- Consider tiered alerting: only page on Critical; queue High for daily review

**Integration with Entra ID not pulling user attributes:**
- Verify service principal permissions: User.Read.All in Microsoft Graph
- Check sync frequency — attributes refresh every 4-24 hours
- Verify user UPN in Cyberhaven matches Entra UPN exactly