Create a Granular Data Profile on Panorama

1. Log in to the Panorama web interface.
2. Select ObjectsDLPData Filtering Profiles.
3. (Optional) Create your classic data profiles on Panorama or advanced data profiles on Strata Cloud Manager.

   You can create a granular data profile that combines predefined data profiles and any custom data profiles you created.
4. Add a new data profile.
5. Enter a descriptive Name for the granular data profile.
6. For the Profile Type, select Granular.
7. Select the File Mode to explicitly include or exclude specific file types from Enterprise DLP inspection.

   • Include—Enterprise DLP only inspects the selected file types configured in the data profiles added to the granular data profile. Enterprise DLP ignores all other forwarded file types.
   • Exclude—The NGFW or Prisma Access tenant ignores the selected File Types and does not send them Enterprise DLP for inspection and verdict rendering. The NGFW or Prisma Access tenant forwards all other file types to Enterprise DLP.
8. In the Profile Selection, Add a data profile.

   Repeat this step to add additional data profiles.

   1. Select the Data Filtering Profile.
   2. Select the File/None-File based traffic to forward to Enterprise DLP.

      You can select File (default), Non-File, or Both.
   3. Select the File Type you want to forward to Enterprise DLP. Click Modify to add one or more supported file types.

      Enterprise DLP prioritizes the File Type settings configured in the granular data profile, and ignores the existing File Type settings configured in the data profile added to the granular data profile.
   4. Select the File Direction you want to inspect.

      You can select Upload, Download, or Both (default).
   5. Select the Action Enterprise DLP takes if inspected traffic contains sensitive data.

      You can select Alert (default) or Block.
   6. Set the Log Severity for the DLP incident when Enterprise DLP detects sensitive data that matches this data profile.

      You can select critical, high, medium, low, or informational (default).
   7. Click OK to add the data profile.
9. (Requires Non-File Data Profile) Configure the URL category list to exclude URL traffic from inspection for non-file based traffic.

   You can configure the URL category list only if you add a non-file based data profile to the granular data profile.

   1. Select URL Category List Excluded From Non-File.
   2. Add a new URL category list.
   3. Select a predefined URL category, custom URL category, or EDL.
10. (Requires Non-File Data Profile) Configure the application exclusion list to exclude application traffic from inspection for non-file based traffic.

    You can configure the application list only if you add a non-file based data profile to the granular data profile. At least one application list or application group is required to create a data filtering profile for inspecting non-file traffic.

    1. Select Application List Excluded From Non-File.
    2. Add an application filter or application group.

       If you did not create a custom application filter or application group, you must add the DLP App Exclusion Filter.
11. (Exclude File Mode Required) Configure the File Types you want to exclude from Enterprise DLP inspection.

    The NGFW or Prisma Access tenant ignores the selected File Types and does not send them Enterprise DLP for inspection and verdict rendering. The NGFW or Prisma Access tenant forwards all other file types to Enterprise DLP

    Click Modify to search for and select the supported file types you want to exclude. This setting applies to all data profiles added to the granular data profile. Click OK after making your selections to continue.
12. Click OK to save your changes.
13. Attach the data filtering profile to a Security policy rule.

    1. Select PoliciesSecurity and specify the Device Group.
    2. Select the Security policy rule to which you want to add the data filtering profile.
    3. Select Actions and set the Profile Type to Profiles.
    4. Select the Data Filtering profile you created previously.
    5. Click OK.
14. Commit and push the new configuration to your managed firewalls.

    The Commit and Push command isn't recommended for Enterprise DLP configuration changes. Using the Commit and Push command requires the additional and unnecessary overheard of manually selecting the impacted templates and managed firewalls in the Push Scope Selection.

    • Full configuration push from Panorama
      1. Select CommitCommit to Panorama and Commit.
      2. Select CommitPush to Devices and Edit Selections.
      3. Select Device Groups and Include Device and Network Templates.
      4. Click OK.
      5. Push your configuration changes to your managed firewalls that are using Enterprise DLP.
    • Partial configuration push from Panorama
      Always include the temporary __dlp administrator when performing a partial configuration push. This is required to keep Panorama and the DLP cloud service in sync.

      For example, you have an admin Panorama admin user who is allowed to commit and push configuration changes. The admin user made changes to the Enterprise DLP configuration and only wants to commit and push these changes to managed firewalls. In this case, the admin user is required to also select the __dlp user in the partial commit and push operations.
      1. Select CommitCommit to Panorama.
      2. Select Commit Changes Made By and then click the current Panorama admin user to select additional admins to include in the partial commit.
         In this example, the admin user is currently logged in and performing the commit operation. The admin user must click admin and then select the __dlp user. If there are additional configuration changes made by other Panorama admins they can be selected here as well.
         Click OK to continue.

      3. Commit.
      4. Select CommitPush to Devices.
      5. Select Push Changes Made By and then click the current Panorama admin user to select additional admins to include in the partial push.
         In this example, the admin user is currently logged in and performing the push operation. The admin user must click admin and then select the __dlp user. If there are additional configuration changes made by other Panorama admins they can be selected here as well.
         Click OK to continue.

      6. Select Device Groups and Include Device and Network Templates.
      7. Click OK.
      8. Push your configuration changes to your managed firewalls that are using Enterprise DLP.