Analyze Discovered Shadow Data

Table of Contents

Start a Shadow Data Discovery Scan

Manage Shadow Data Discovery Groups

Analyze Discovered Shadow Data

Analyze the shadow data discovery results to learn more about the types of data that exists in your organization.

Where Can I Use This?	What Do I Need?
Strata Cloud Manager	Data Security license Enterprise DLP license Or any of the following licenses that include the Enterprise DLP and Data Security licenses Prisma Access CASB license Next-Generation CASB for Prisma Access and NGFW (CASB-X) license Data Security license

Where Can I Use This?

What Do I Need?

Strata Cloud Manager

Data Security license
Enterprise DLP license

Or any of the following licenses that include the Enterprise DLP and Data Security licenses

Prisma Access CASB license
Next-Generation CASB for Prisma Access and NGFW (CASB-X) license
Data Security license

Contact Palo Alto Networks to enable Shadow Data Discovery on your tenant.

After Enterprise Data Loss Prevention (E-DLP) successfully scans your organization's shadow data, you can analyze the shadow data discovery results to understand what types of data exist in your organization. Enterprise DLP organizes scanned documents into AI-generated categories mapped to groups, giving you a clear view of how your organization stores its documents and information, with groups at the top level and categories nested within them. The results help guide your data governance strategy and help identify previously unknown sensitive documents. This enables you to evaluate the effectiveness of your current data protection policy by seeing what types of sensitive documents Enterprise DLP discovered that your existing data profiles missed.

Additionally, Enterprise DLP assigns a sensitivity score to each shadow data document to indicate the likelihood that it contains potentially sensitive data based on the content analysis. This score helps you understand which documents might require additional protection even if they weren't flagged by your existing data security measures.

Enterprise DLP provides recommendations for which predefined data profiles contain sensitive data match criteria that Palo Alto Networks recommends you should enable based on the analyzed content in the shadow data documents. These suggestions help you understand what types of standard sensitive data detection rules would be most relevant for your organization's actual data landscape.

Top Groups
The Top Groups section shows you the most significant shadow data groups discovered by Enterprise DLP in your organization's data. Each group is a broad predefined or custom classification that categories map to, displayed as visual bubbles where larger sizes indicate groups containing more documents.
Each group bubble displays the total number of Discovered Files attributed to that group. Additionally, Enterprise DLP assigns a risk level (High, Medium, or Low) to each group to help you visually distinguish between shadow data that likely carries a higher risk of containing sensitive data from those that have a lower risk.
You can apply additional filtering to show the Top 5 Groups by Sensitivity, Top 10 Groups by Sensitivity, or Top 15 Groups by Sensitivity. If you have fewer than 15 groups, the Top 15 Groups by Sensitivity displays the actual total number of groups.
Hover your mouse over a group to read a description of the shadow data group to learn more about the types of shadow data associated with that group. Click a specific group to filter the Overview and Group Detail data for the selected group.
Overview
The Overview displays a high-level summary of all shadow data discovery findings across your organization or for a specific group you select. The overview displays the following information for all groups:
- Discovered Files—Number of shadow data documents analyzed by Enterprise DLP.
- Channels—Number of channels that contained shadow data analyzed by Enterprise DLP.
- File Types—Number of unique file types discovered across all groups.
- Groups—Number of unique shadow data groups.
The Overview doesn't display any information when you select a specific group.
Group Detail
The Group Detail section displays comprehensive information about all discovered groups and their categories, or for a specific group if you have one selected.
- Applications—All apps and total number of shadow data files they contain analyzed by Enterprise DLP across all discovered shadow data or for a specific group.
- File Types—All unique shadow data file types discovered across all groups or for a specific group.
Example for All Groups

Example for a Selected Group
Groups
The Groups section displays a comprehensive list of all discovered shadow data groups by default. Alternatively, this section displays group-specific information if you select a specific group from the Top Groups section or from the Groups list. You can sort using any combination of a time (Past Day, Past 7 Days, Past Month, or Past 3 Months), the Applications, File Types, and Sensitivity Score filter.
Click Group Management to view and manage your shadow data groups, including creating custom groups, editing group descriptions, and mapping categories to groups.
Expand the Actions menu and Review Files to remediate discovered shadow data.
- Group—The predefined or custom group that Enterprise DLP mapped this category to.
  Click the group name to view all categories and files associated with the group. From the group file list, you can Review Files to remediate discovered shadow data.
- Category—AI-generated category name for the shadow data cluster.
  Enterprise DLP categorizes all discovered shadow data in English, even if the source files are in other languages.
  Hover your mouse over the +<#> to display the full list if there is more than one category.
- Description—Describes the types of shadow data files associated the shadow data group.
- Shadow Files—Total number of files associated with the category.
- Sensitivity Level—AI-generated score indicating the likelihood of sensitive data being present within the files associated with the category.
  When viewing files within a category, indicates the likelihood of sensitive data being present within a specific file.
  Can display Low, Medium, or High.
- File Types—All file types associated with the category. Hover your mouse over the +<#> to display the full list if there is more than one file type.
  When viewing files within a category, displays the file type of the specific file.
- Applications—All apps associated with the category. Hover your mouse over the +<#> to display the full list if there is more than one app.
  When viewing files within a category, displays the app where Enterprise DLP detected the file.
- Users—Number of users who own the shadow data files in a particular group.
- Detected On—Date Enterprise DLP detected and created the shadow data category.
  When viewing files within a category, displays the date Enterprise DLP detected the file.