Enterprise DLP
Set Up Cloud Storage on Microsoft Azure to Save Evidence
Table of Contents
Set Up Cloud Storage on Microsoft Azure to Save Evidence
Configure cloud storage on Microsoft Azure to save evidence for investigative
analysis with
Enterprise Data Loss Prevention (E-DLP)
.Where Can I Use This? | What Do I Need? |
---|---|
|
|
Microsoft Azure users can configure a blog storage bucket bucket to automatically
upload all files that match an
Enterprise Data Loss Prevention (E-DLP)
data profile for Enterprise DLP
.To store your files scanned by the DLP cloud service, you must create a storage
account and Identity and Access Management (IAM) role that allows the DLP cloud
service access to automatically store files. Files uploaded to your storage account
are automatically named using a unique Report ID for each file. The Report ID is
used to search and download specific files for more in-depth investigation.
In case of connection issues to your storage account due to configuration error or
change in settings, an email is automatically generated and sent to the admin that
originally connected to
Enterprise DLP
to the storage bucket and to the user
who last modified the storage account connection settings. This email is sent out
every 48 hours until the connection is restored.Files scanned by the DLP cloud service while
Enterprise DLP
was disconnected
from your storage account can’t be stored and are lost. This means that all
impacted files aren’t available for download. However, all snippet data is
preserved and can still be viewed in the Enterprise DLP
File storage automatically resumes after the connection status is restored.
Strata Cloud Manager
Strata Cloud Manager
Configure cloud storage on Microsoft Azure to save evidence for investigative analysis
with
Enterprise DLP
for Prisma Access (Managed by Strata Cloud Manager)
and SaaS Security
on Strata Cloud Manager
.- Review the Setup Prerequisites for Enterprise DLP and enable the required ports, full qualified domain names (FQDN), and IP addresses on your network.
- Log in to the Microsoft Azure portal as an administrator.Administrator level privileges are required to successfully add theEnterprise DLPevidence storage application using Cloud Shell and to configure access to the storage account to enable file uploads by the DLP cloud service to save files for evidence analysis.
- You can also search forstorage groups.The storage group is required to associate the storage account you create next for storing matched files.Skip this step if you have an existing resource group that you want to associate with the storage account.
- You can also search forstorage accounts.
- Obtain the App-ID, Tenant ID, and blob service endpoint URL.This information is required to add the Palo Alto NetworksEnterprise DLPapplication to your Microsoft Azure tenant and to configure connectivity to the DLP cloud service.
- Palo Alto Networks- 65def4b7-bae6-4bff-ab73-63fe8c9a3c8dEnterprise DLPApp IDThe Palo Alto NetworksEnterprise DLPApp-ID can be found in the DLP app on the hub ().SettingsSensitive DataConfigure BucketAzure
- Obtain your Tenant ID.
- From the portal menu, selectAzure Active Directory.You can also search forazure active directory.
- In the Basic Information section, copy theTenant ID.
- Obtain the blob service endpoint URL.
- From the portal menu, selectStorage accountsand select the storage account you will use to save files for evidence analysis.
- Selectand copy theSettingsEndpointsBlob serviceendpoint URL.
- Add the Palo Alto NetworksEnterprise DLPapplication.
- OpenCloud Shell.Click the Cloud Shell icon located in the top-right corner of the Microsoft Azure portal.
- Add the Palo Alto NetworksEnterprise DLPapplication.Connect-AzureAD -TenantID <Your_Tenant_ID>New-AzureADServicePrincipal -AppId 65def4b7-bae6-4bff-ab73-63fe8c9a3c8dIt might take a few minutes for Microsoft Azure to add a new application to your Azure tenant.
- Close the Cloud Shell.
- Search for and selectEnterprise applications.
- For the Application type, selectAll applications.
- Search for thePalo Alto Networksapplication name to verify you successfully added the application.Enterprise DLP
- Configure permissions for the Palo Alto NetworksEnterprise DLPapplication.
- Select thePalo Alto Networksapplication name.Enterprise DLP
- SelectandSecurityPermissionsGrant Admin consent.
- Select the administrator email in the Microsoft login prompt that is displayed.
- Acceptthe permissions request to allow the Palo Alto NetworksEnterprise DLPapplication to view your Azure storage accounts.It might take a few minutes for the permissions to be successfully granted to the Palo Alto NetworksEnterprise DLPapplication.You still need to grant the Palo Alto NetworksEnterprise DLPapplication permission to write to a specific storage account.
- Verify that theAzure StorageandMicrosoft GraphAPI names are displayed in theAdmin consentsection.
- From the portal menu, selectStorage accountsand select the storage account you want to use to save files for evidence analysis.
- Selectand clickAccess Control (IAM)AddAdd Role AssignmentStorage Blob Data OwnerNext.
- Select to assign access toUser, group, or service principleandselect members.
- Search and select thePalo Alto Networksapplication andEnterprise DLPSelectthe application.
- Review + assignto allow the Palo Alto NetworksEnterprise DLPapplication to write to the storage account.It can take up to 10 minutes for the write permissions to be successfully granted to the Palo Alto NetworksEnterprise DLPapplication.
- Configure the storage bucket for evidence file storage.
- Log in toStrata Cloud Manager.Access to evidence storage settings and files onStrata Cloud Manageris allowed only for an account administrator or app administrator role withEnterprise DLPread and write privileges. This is to ensure that only the appropriate users have access to report data and evidence.
- Selectand selectManageConfigurationData Loss PreventionSettingsSensitive DataAzureas the Public Cloud Storage Bucket.
- SelectInput Bucket Details.
- Enter Microsoft Azure Tenant ID.
- Enter the Storage Endpoint.This is the blob service endpoint URL that you gathered for the storage account.
- Connectthe storage account and the DLP cloud service.
- View theConnection Statusto verify that the DLP cloud service successfully connected to the storage account.SelectSaveifStrata Cloud Managercan successfully connect your bucket. Aconnectiontestfile is uploaded to your storage account by the DLP cloud service to verify connectivity.IfStrata Cloud Managercan’t successfully connect your bucket, selectPreviousand edit the bucket connection settings.
- In the Store Sensitive Files settings, enable storage of sensitive files forStrata Cloud Manager.
Panorama
Panorama
Configure cloud storage on Microsoft Azure to save evidence for investigative
analysis with
Enterprise Data Loss Prevention (E-DLP)
.- Review the Setup Prerequisites for Enterprise DLP and enable the required ports, full qualified domain names (FQDN), and IP addresses on your network.
- Log in to the Microsoft Azure portal as an administrator.Administrator level privileges are required to add theEnterprise DLPevidence storage application using Cloud Shell and to configure access to the storage account to enable file uploads by the DLP cloud service to save files for evidence analysis.
- You can also search forstorage groups.The storage group is required to associate the storage account you create next for storing matched files.Skip this step if you have an existing resource group that you want to associate with the storage account.
- You can also search forstorage accounts.
- Obtain the App-ID, Tenant ID, and blob service endpoint URL.This information is required to add the Palo Alto NetworksEnterprise DLPapplication to your Microsoft Azure tenant and to configure connectivity to the DLP cloud service.
- Palo Alto Networks Enterprise DLP App ID- 65def4b7-bae6-4bff-ab73-63fe8c9a3c8dThe Palo Alto NetworksEnterprise DLPApp-ID can be found in the DLP app on the hub ().SettingsSensitive DataConfigure BucketAzure
- Obtain your Tenant ID.
- From the portal menu, selectAzure Active Directory.You can also search forazure active directory.
- In the Basic Information section, copy theTenant ID.
- Obtain the blob service endpoint URL.
- From the portal menu, selectStorage accountsand select the storage account you will use to save files for evidence analysis.
- Selectand copy theSettingsEndpointsBlob serviceendpoint URL.
- Add the Palo Alto NetworksEnterprise DLPapplication.
- OpenCloud Shell.Click the Cloud Shell icon located in the top-right corner of the Microsoft Azure portal.
- Add the Palo Alto NetworksEnterprise DLPapplication.Connect-AzureAD -TenantID <Your_Tenant_ID>New-AzureADServicePrincipal -AppId 65def4b7-bae6-4bff-ab73-63fe8c9a3c8dIt might take a few minutes for Microsoft Azure to add a new application to your Azure tenant.
- Close the Cloud Shell.
- Search for and selectEnterprise applications.
- For the Application type, selectAll applications.
- Search for thePalo Alto Networks Enterprise DLPapplication name to verify you successfully added the application.
- Configure permissions for the Palo Alto NetworksEnterprise DLPapplication.
- Select thePalo Alto Networks Enterprise DLPapplication name.
- SelectandSecurityPermissionsGrant Admin consent.
- Select the administrator email in the Microsoft login prompt that is displayed.
- Acceptthe permissions request to allow the Palo Alto NetworksEnterprise DLPapplication to view your Azure storage accounts.It might take a few minutes for the permissions to be successfully granted to the Palo Alto NetworksEnterprise DLPapplication.You still need to grant the Palo Alto NetworksEnterprise DLPapplication permission to write to a specific storage account.
- Verify that theAzure StorageandMicrosoft GraphAPI names are displayed in the Admin consent section.
- From the portal menu, selectStorage accountsand select the storage account you want to use to save files for evidence analysis.
- Selectand clickAccess Control (IAM)AddAdd Role AssignmentStorage Blob Data OwnerNext.
- Select to assign access toUser, group, or service principleandselect members.
- Search and select thePalo Alto Networks Enterprise DLPapplication andSelectthe application.
- Review + assignto allow the Palo Alto Networks Enterprise DLP application to write to the storage account.It can take up to 10 minutes for the write permissions to be successfully granted to the Palo Alto NetworksEnterprise DLPapplication.
- Configure the storage bucket for evidence file storage.
- Log in to the DLP app on the hub.If you don’t already have access to the DLP app on the hub, see the hub Getting Started Guide. Only Superusers can access the hub.Access to evidence storage settings and files on the hub is allowed only for an account administrator or app administrator roles with a validEnterprise DLPlicense associated with that support account. This is to ensure that only the appropriate users have access to report data and evidence.
- Selectand selectSettingsSensitive Dataas the Public Cloud Storage Bucket.Configure BucketAzure
- SelectInput Bucket Details.
- Enter Microsoft Azure Tenant ID.
- Enter the Storage Endpoint.This is the blob service endpoint URL that you gathered for the storage account.
- Connectthe storage account and the DLP cloud service.
- View theConnection Statusto verify that the DLP cloud service successfully connected to the storage account.Saveif the DLP app can successfully connect to your resource group. Aconnectiontestfile is uploaded to your storage account by the DLP cloud service to verify connectivity.If the DLP app can’t successfully connect to your resource group, selectPreviousand edit the connection settings.
- In the DLPSettings,Enable forto enable evidence storage for Palo Alto Networks Next-Gen Firewalls (NGFW) andNGFW (PAN-OS or Panorama Managed)Prisma Access (Managed by Panorama).You can alsoEnable forfrom the DLP app if you’re usingPrisma AccessEnterprise DLPonPrisma Access (Managed by Strata Cloud Manager).You can only enable storage of sensitive files for platform for which you have activated theEnterprise DLPlicense. For example, you only have the option to enable evidence storage for Next-Generation Firewalls (NGFW) if you activated theEnterprise DLPlicense onPanorama.