While detecting malicious attacks is critical for preventing a serious security incident, ensuring internal compliance and upholding security policies are equally critical. This is where Declarations of Policy Violations (DoPV) from Clear NDR provide a powerful solution, offering continuous, real-time oversight of your organization's security posture.

What is a Declaration of Policy Violation (DoPV)?

Similar to a Declaration of Compromise (DoC), a DoPV is a high-confidence and high-priority incident detection event in Clear NDR. However, instead of focusing on direct security threats, DoPVs address internal compliance and security policy enforcement. They identify "unauthorized" activities that, while not necessarily malicious, still pose a significant risk to the organization.

Continuous Compliance and Security Audits in Real-Time

The true power of DoPVs lies in their ability to provide security, governance, risk, and compliance personnel with a continuous and real-time understanding of significant policy violations occurring within their organizations. This moves compliance from a periodic audit to an ongoing, dynamic process.

Examples of activities that can trigger a DoPV include:

• Insecure Protocols: Detection of unencrypted or legacy protocols being used.
• Outdated TLS Versions/Expired Certificates: Identifying systems using vulnerable or expired encryption.
• Vulnerable Systems/Software: Pinpointing systems running applications or operating systems with known vulnerabilities.
• TOR Browser Usage: Flagging the use of anonymization protocols that can bypass controls.
• Unencrypted (Clear Text) Passwords: Detecting sensitive information transmitted insecurely.
• Adware: Identifying unwanted software designed to display advertisements, which can be weaponized.
• Potential Data Leakage: Highlighting behaviors or conditions that could lead to unauthorized data exposure or exfiltration.

Key Characteristics of DoPVs:

Like DoCs, DoPVs share several fundamental characteristics:

• Asset-oriented: Each DoPV is associated with a single asset, centralizing evidence.
• High confidence, high-fidelity: DoPVs are designed to trigger accurately when policy violations occur.
• Low noise: Only the first detection of a specific policy violation against an asset generates a DoPV.
• Effective with UI or SIEM: DoPV events provide detailed information for investigation, whether in the Clear NDR UI or integrated with a SIEM.
• Built-in and/or customized: Beyond the daily updated built-in detections, users can create custom DoPV rules through an "escalation" process to address unique organizational policies.

Automating Policy Enforcement

DoPVs can trigger automated responses, just like DoCs. Making API calls, they can integrate with external systems to initiate actions such as:

• Creating incident tickets in an IR system
• Sending notifications to relevant teams
• Initiating SOAR playbooks for policy remediation
• Generating email alerts to stakeholders

A Comprehensive Approach to Security Posture

By providing distinct yet complementary insights, DoPVs, alongside DoCs, create a comprehensive security posture management solution. While DoCs focus on external threats, DoPVs ensure internal adherence to security policies. This dual approach helps organizations bridge the gap between raw network data and actionable security intelligence, transforming security operations into proactive incident management and ensuring both efficiency and effectiveness in modern cybersecurity.

Further Reading

For a more in-depth understanding, read our full Tech Brief on Declarations of Compromise and Declarations of Policy Violations on our website: https://www.stamus-networks.com/hubfs/Library/Documents%20(PDFs)/StamusNetworks-TB-FILTERS-072025-1.pdf 

To learn how analysts can pivot from a DoC to a complete package of evidence in two clicks, check out this blog entitled “Two Clicks to Evidence,” here: https://www.stamus-networks.com/blog/reduce-mean-time-to-detection-2-clicks-to-evidence-with-clear-ndr 

 To understand how Clear NDR can dramatically reduce the costs associated with retaining network forensic evidence, read these two docs:

• Optimizing Clear NDR™ Storage with Conditional Logging - https://www.stamus-networks.com/hubfs/Library/Documents%20(PDFs)/StamusNetworks-TB-CONDITIONAL-LOG-042025-1.pdf 
• Reduce the Costs of SIEM Data Retention with Clear NDR™ - https://www.stamus-networks.com/hubfs/Library/Documents%20(PDFs)/StamusNetworks-TB-CUT-SIEM-INGEST-042025-1.pdf