>
    Strata Copilot
    Set Up the EDM CLI App
    Focus
    Download PDF
    Focus
    1. Home
    2. Enterprise DLP
    3. Administration
    4. Configure Enterprise DLP
    5. Exact Data Matching (EDM)
    6. Set Up the EDM CLI App
    Download PDF
    Enterprise DLP

    Set Up the EDM CLI App

    Table of Contents

    Set Up the EDM CLI App

    Download the secure Exact Data Matching (EDM) CLI app on your local Windows or Linux device.
    On May 7, 2025, Palo Alto Networks is introducing new Evidence Storage and Syslog Forwarding service IP addresses to improve performance and expand availability for these services globally.
    You must allow these new service IP addresses on your network to avoid disruptions for these services. Review the Enterprise DLP Release Notes for more information.
    Where Can I Use This?What Do I Need?
    • NGFW (Managed by Panorama or Strata Cloud Manager)
    • Prisma Access (Managed by Panorama or Strata Cloud Manager)
    • Prisma Browser
    • Enterprise Data Loss Prevention (E-DLP) license
      Review the Supported Platforms for details on the required license for each enforcement point.
    Or any of the following licenses that include the Enterprise DLP license
    • Prisma Access CASB license
    • Next-Generation CASB for Prisma Access and NGFW (CASB-X) license
    • Data Security license
    The Exact Data Matching (EDM) CLI app is a secure CLI tool used to upload hash encrypted EDM datasets to Enterprise Data Loss Prevention (E-DLP). The EDM CLI app accepts a source file in CSV or TSV format. The EDM CLI app then generates an encrypted hash EDM dataset with AES-256 encryption of the source file and saves it as a zip file that you can upload to Enterprise DLP. The EDM CLI app applies a one-way hash to each field in the CSV or TSV file that is then encoded in Base64. After securing the file, the EDM CLI app generates a zip file containing the secured dataset.
    The EDM CLI app is supported on Microsoft Windows and Linux operating systems such as Ubuntu, Debian, and CentOS.
    You download the EDM CLI app from Strata Cloud Manager and includes the following:
    • README.TXT—Quick overview of the EDM CLI app functionality, including descriptions of data types and column values.
    • edm-secure-cli-<version>.jar—The executable Java app.
    • config.properties—Configuration file you can prepopulate to upload a file to Enterprise DLP.
    • upload_config.properties—Configuration file for the connectivity settings to connect to Enterprise DLP.
    • lib—Directory containing all the dependency libraries required by the EDM Secure CLI app.
    • log4j2.xml—Configuration files for debugging and logging.
    • sample_dataset.csv—Sample CSV file you can use as a template for upload to Enterprise DLP.
    • (Windows) edm-secure-cli.bat—Windows batch file used to create and upload an EDM dataset to Enterprise DLP.
      (Linux) edm-secure-cli.sh—Bash script used to create and upload an EDM dataset to Enterprise DLP.
    1. Review the setup prerequisites for Enterprise DLP before you set up the EDM CLI app.
      Allow the required FQDNs and IP addresses listed here to successfully upload EDM datasets and forward traffic to Enterprise DLP for inspection.
    2. Deploy the device you will use to upload EDM datasets to Enterprise DLP.
      You can upload EDM datasets to Enterprise DLP using any physical or virtual device running a Windows or Linux operating system.
      If you plan to deploy a dedicated virtual machine to upload EDM datasets to Enterprise DLP, Palo Alto Networks recommends you allocate a minimum of four CPUs and 8 GB memory to the virtual machine.
    3. Log in to Strata Cloud Manager.
    4. Enable Exact Data Matching (EDM).
    5. Create a Service Account for EDM Dataset Uploads
    6. Download the EDM CLI app.
      The entire contents of the EDM CLI app are downloaded as a .zip file.
      1. Select ConfigurationData Loss PreventionDetection MethodsExact Data Matching and expand the EDM Setup Guide
      2. Click Download EDM Tool and Download the latest version of the EDM CLI app.
        • Select Windows 64-bit if you’re installing the EDM CLI app on a Microsoft Windows device.
        • Select Linux 64-bit if you're installing the EDM CLI app on a Linux device.
        • Select and download the latest EDM CLI version available.
          Download version 4.0 or later to upload EDM datasets to a specific supported EDM dataset upload region.
          Download version 5.0 or later to upload EDM datasets containing supported currencies and for enhanced date detection capabilities.
          Download version 6.0 or later to upload EDM datasets containing Brazil CPF numbers and encrypt your Client ID and Client Secret.
          Download version 6.1 or later to upload EDM datasets containing Hebrew script.
          If you use an older unsupported version of the CLI, the CLI will display an error message: Please use the latest version of cli tool. Latest version: <latest-version>.
    7. (Optional) Create a new folder for EDM on your local device.
      The EDM CLI app generates secured versions of all EDM datasets uploaded to Enterprise DLP and logs for EDM CLI app activity. As a best practice, create a folder just for the EDM CLI app to contain all EDM-specific files to a single folder.
      Refer to the documentation for Microsoft Windows or your specific Linux OS for more information on creating a new folder.
    8. Extract the EDM zip file contents.
      1. On your local device, navigate to the downloaded package-edm-secure-cli-<version>-<platform>.zip file.
      2. Right-click the package-edm-secure-cli-<version>-<platform>.zip file and click Extract To.
      3. Select a folder and Extract.
        (Best Practices) Select the folder you created for your EDM CLI app files.
    9. Verify the extracted .zip file contains all the required EDM CLI app files.
    10. Install Java on your local device.
      The EDM CLI app requires a 64-bit Java version, such as JDK 64-Bit, to run.
      EDM CLI App 4.0 and later require JDK version 17 or later. Skip this step if you already have the latest JDK version installed
      1. Open the terminal and view the Java version currently installed.
        admin: java -version
      2. Install the latest version of Java.
        sudo apt install openjdk-<version>-jdk
    11. (Linux only) Make the EDM CLI app script readable, writable, and executable.
      1. Navigate to the directory where you extracted the EDM CLI app .zip contents.
        In this example, we extracted the package-edm-secure-cli-<version>-<platform>.zip contents to the EDM directory.
      2. Make the EDM CLI app script readable, writable, and executable.
        admin: chmod 777 ./edm-secure-cli.sh
    12. Create a Service Account for EDM Dataset Uploads.
    13. Configure EDM CLI App Connectivity to Enterprise DLP.

    © 2026 Palo Alto Networks, Inc. All rights reserved.