Modify a DLP Rule on Strata Cloud Manager

Modify a DLP Rule on Strata Cloud Manager

1. Log in to Strata Cloud Manager.
2. Create a data profile.
3. Select ManageConfigurationData Loss PreventionDLP Rules and in the Actions column, Edit the DLP rule.

   The DLP rule has an identical name as the data profile from which it was automatically created.
4. (Optional) Enter a Description for the DLP rule.
5. Modify the DLP rule Match Criteria.

   Expand all
   Collapse all
   • File Based
     1. Enable DLP rule match criteria for file-based based traffic.
     2. (Prisma Access 5.1 and later) Select the File Scan Mode to explicitly include or exclude specific file types.
        A DLP rule supports only one type of file mode. You can't configure a DLP rule to both include and exclude specific file types.
        • Include—Enterprise DLP only inspects the selected file types. The NGFW or Prisma Access tenant ignores all other file types and does not forward them to Enterprise DLP for inspection and verdict rendering.
        • Exclude—The NGFW or Prisma Access tenant excludes the selected file types and does not send them Enterprise DLP for inspection and verdict rendering. The NGFW or Prisma Access tenant forwards all other file types to Enterprise DLP but Enterprise DLP inspects and renders verdicts only on supported file types.
     3. Specify one or more supported file types to include in the match criteria.
        All supported file types are included in the match criteria by default.
     4. Specify the File Direction (Upload, Download, or Both).
        The default file direction is Upload. File direction support is dependent on the app. Review the list of supported apps to learn which file directions Enterprise DLP supports.

     

   • Non-File Based
     1. Enable DLP rule match criteria for non-file based traffic.
     2. Select the URL Category List Exclusions to exclude forwarding traffic from one or more specific URLs to Enterprise DLP.
        You can use a predefined URL category or create a custom URL category in the Global Configuration Scope. You can select multiple URL categories to exclude traffic from non-file inspection.
     3. Select the Application List Exclusion to exclude forwarding traffic from one or more specific apps to Enterprise DLP.
        You can use a predefined application filter or create a custom application filter in the Global Configuration Scope. You can select multiple application filters to exclude app traffic from non-file inspection.
        Enterprise DLP requires at least one Application Filter if you enable exclusions for non-file based traffic. Palo Alto Networks recommends adding the predefined DLP App Exclusion application filter if you don't have a custom or predefined application filter you want to add.

     
6. Configure the Action & Log settings.

   1. Select the Action (Alert, or Block) taken when Enterprise DLP detects sensitive data.

      The default action is Alert.
   2. Set the Log Severity when Enterprise DLP detects traffic that matches the DLP rule.

      The default severity is Low.
7. (Best Practices for File Based Inspection) Create a File Blocking profile and create a Block Rule to block the file types you don't explicitly forwarded to Enterprise DLP.

   Palo Alto Networks recommends creating this File Blocking profile to ensure sensitive data can't be exfiltrated in file types Enterprise DLP doesn't support.
8. Create a Shared Profile Group for the Enterprise DLP data filtering profile.

   1. Select ManageConfigurationNGFW and Prisma AccessSecurity ServicesProfile Groups and Add Profile Group.
   2. Enter a descriptive Name for the Profile Group.
   3. (Best Practices for File Based Inspection) For the File Blocking Profile, select the File Blocking profile you created in the previous step.
   4. For the Data Loss Prevention Profile, select the Enterprise DLP data profile.
   5. Add any other additional profiles as needed.
   6. Save the profile group.
9. Create a Security policy rule and attached the Profile Group.

   1. Select ManageConfigurationNGFW and Prisma AccessSecurity ServicesSecurity Policy and Add Rule.

      You can also update an existing Security policy to attach a Profile Group for Enterprise DLP filtering.
   2. Configure the Security policy as needed.
   3. Navigate to the Action and Advanced Inspection section, and select the Profile Group you created in the previous step.
   4. Save the Security policy.
10. Push Config and push your configuration changes.