>
    Set Up SFTP Storage to Save Evidence
    Focus
    Download PDF
    Focus
    1. Home
    2. Enterprise DLP
    3. Enterprise DLP Administration
    4. Monitor Enterprise DLP
    5. Save Evidence for Investigative Analysis with Enterprise DLP
    6. Set Up SFTP Storage to Save Evidence
    Download PDF
    Enterprise DLP

    Set Up SFTP Storage to Save Evidence

    Table of Contents

    Set Up SFTP Storage to Save Evidence

    Connect SFTP server to store files that match your
    Enterprise Data Loss Prevention (E-DLP)
     data profiles.
    Where Can I Use This?
    What Do I Need?
    • Panorama
    • Prisma Access (Managed by Strata Cloud Manager)
    • SaaS Security
    • NGFW (Managed by Strata Cloud Manager)
    • Enterprise Data Loss Prevention (E-DLP)
       license and any of the following:
      • Panorama
        —Support and device management licenses
      • Prisma Access (Managed by Strata Cloud Manager)
        —
        Prisma Access
         license
      • SaaS Security
        —
        SaaS Security
         license
      • NGFW (Managed by Strata Cloud Manager)
        —Support and
        AIOps for NGFW Premium
         licenses
      Or
    • Any of the following licenses
      • Prisma Access
         CASB license
      • Next-Generation CASB for Prisma Access and NGFW (CASB-X)
         license
      • Data Security
         license
    To store your files scanned by the DLP cloud service, you must specify the SFTP server connectivity information to successfully upload and write files to a target location on the SFTP server. When the DLP cloud service uploads a file to your SFTP server, a
    reportId
     folder is created by default. All files uploaded to your SFTP server by the DLP cloud service are uploaded to the
    reportId
     folder within your folder path. Files uploaded to your SFTP server are automatically named using the SFTP target folder location, default
    reportId
     folder, and filename.
    In case of connection issues to your SFTP server due to configuration error or change in settings on the SFTP server, an email is automatically generated and sent to the admin that originally connected
    Enterprise DLP
     to the SFTP server and to the user who last modified the storage bucket connection settings. This email is sent out every 48 hours until the connection is restored.
    Files that are scanned by the DLP cloud service while
    Enterprise DLP
     is disconnected from your storage bucket can’t be stored and are lost. This means that all impacted files aren’t available for download. However, all snippet data is preserved and can still be viewed on
    Enterprise DLP
     on the hub.
    File storage automatically resumes after the connection status is restored.
    This procedure assumes you have already set up an SFTP server to save evidence for investigative analysis.

    Strata Cloud Manager

    Connect
    Strata Cloud Manager
     to your SFTP server to store files that match your
    Enterprise Data Loss Prevention (E-DLP)
     data profiles.
    1. Review the Setup Prerequisites for Enterprise DLP and enable the required ports, full qualified domain names (FQDN), and IP addresses on your network.
    2. Log in to
      Strata Cloud Manager
      .
      Access to evidence storage settings and files on
      Strata Cloud Manager
       is allowed only for an account administrator or app administrator role with
      Enterprise DLP
       read and write privileges. This is to ensure that only the appropriate users have access to report data and evidence.
    3. Select
      Manage
      Configuration
      Security Services
      Data Loss Prevention
      Settings
      Sensitive Data
       and select
      Configure Bucket
      SFTP
       as the Public Cloud Storage Bucket.
    4. Review the
      Instructions - SFTP
       and click
      Next
      .
    5. Input Bucket Details
       to configure the SFTP server connection settings.
      1. Enter the
        Username
         of the SFTP server user used for secure file uploads.
        The user is required to have read and write access to the SFTP server.
      2. Enter the
        Private Key
         for the SFTP server.
        This is required to authenticate the SSH connection to the SFTP server. The
        Private Key
         must include both the
        BEGIN RSA PRIVATE KEY
         and
        END RSA PRIVATE KEY
         prompts.
      3. (
        Optional
        ) Enter the public
        PGP Key
         to sign and encrypt files uploaded to the SFTP server.
        Pretty Good Privacy (PGP) is an encryption program providing privacy and authentication for data communication, and used for signing, encrypting, and decrypting files. The
        PGP Key
         must include both the
        BEGIN RSA PRIVATE KEY
         and
        END RSA PRIVATE KEY
         prompts.
      4. Enter the
        Hostname
         of the SFTP server.
        The
        Hostname
         can be a Fully Qualified Domain Name (FQDN) or an IPv4 address.
      5. (
        Optional
        ) Enter the
        Folder Path
         for uploaded files to specify the target location where files are uploaded to on the SFTP server.
        If no
        Folder Path
         is specified, the DLP cloud service creates the default
        reportId
         folder at the top-most folder the
        Username
         has read and write access to. The folder path for uploaded files depends on whether a
        Folder Path
         is specified.
        • Folder Path Specified
          —<
          folder path
          >
          /reportId/
          <
          file name
          >
        • Folder Path Not Specified
          —
          /reportId/
          <
          file name
          >
      6. Enter the
        Port
         number through which files are uploaded to the SFTP server.
        Palo Alto Networks recommends using Port 22 for file uploads to your SFTP server. For uncommon ports,
        Enterprise DLP
         needs to open the egress port for connection and upload.
    6. Connect
       to the SFTP server.
      As part of the setup process, a file called
      Palo_Alto_Networks_DLP_Connection_Test.txt
       is uploaded to the target
      Folder Path
       on your SFTP server. Connectivity between the DLP cloud service and your SFTP server is successful if DLP cloud service successfully uploads the test file.
      The
      Connection Status
       displays whether the initial connection test was successful. Continue to the next step when the
      Bucket connected successfully
      .
      Click
      Previous
       if the connection isn’t successful to modify the SFTP server and connection settings as needed.
    7. Save
       the SFTP server connectivity settings.

    Panorama

    Connect the DLP app to your SFTP server to store files that match your
    Enterprise Data Loss Prevention (E-DLP)
     data filtering profiles.
    1. Review the Setup Prerequisites for Enterprise DLP and enable the required ports, full qualified domain names (FQDN), and IP addresses on your network.
    2. Log in to the DLP app on the hub.
      If you don’t already have access to the DLP app on the hub, see the hub Getting Started Guide. Only Superusers can access the hub.
      Access to evidence storage settings and files on the hub is allowed only for an account administrator or app administrator roles with a valid
      Enterprise DLP
       license associated with that support account. This is to ensure that only the appropriate users have access to report data and evidence.
    3. Select
      Settings
      Sensitive Data
       and select
      Configure Bucket
      SFTP
       as the Public Cloud Storage Bucket.
    4. Review the
      Instructions - SFTP
       and click
      Next
      .
    5. Input Bucket Details
       to configure the SFTP server connection settings.
      1. Enter the
        Username
         of the SFTP server user used for secure file uploads.
        The user is required to have read and write access to the SFTP server.
      2. Enter the
        Private Key
         for the SFTP server.
        This is required to authenticate the SSH connection to the SFTP server. The
        Private Key
         must include both the
        BEGIN RSA PRIVATE KEY
         and
        END RSA PRIVATE KEY
         prompts.
      3. (
        Optional
        ) Enter the public
        PGP Key
         to sign and encrypt files uploaded to the SFTP server.
        Pretty Good Privacy (PGP) is an encryption program providing privacy and authentication for data communication, and used for signing, encrypting, and decrypting files. The
        PGP Key
         must include both the
        BEGIN RSA PRIVATE KEY
         and
        END RSA PRIVATE KEY
         prompts.
      4. Enter the
        Hostname
         of the SFTP server.
        The
        Hostname
         can be a Fully Qualified Domain Name (FQDN) or an IPv4 address.
      5. (
        Optional
        ) Enter the
        Folder Path
         for uploaded files to specify the target location where files are uploaded to on the SFTP server.
        If no
        Folder Path
         is specified, the DLP cloud service creates the default
        reportId
         folder at the top-most folder the
        Username
         has read and write access to. The folder path for uploaded files depends on whether a
        Folder Path
         is specified.
        • Folder Path Specified
          —<
          folder path
          >
          /reportId/
          <
          file name
          >
        • Folder Path Not Specified
          —
          /reportId/
          <
          file name
          >
      6. Enter the
        Port
         number through which files are uploaded to the SFTP server.
        Palo Alto Networks recommends using Port 22 for file uploads to your SFTP server. For uncommon ports,
        Enterprise DLP
         needs to open the egress port for connection and upload.
    6. Connect
       to the SFTP server.
      As part of the setup process, a file called
      Palo_Alto_Networks_DLP_Connection_Test.txt
       is uploaded to the target
      Folder Path
       on your SFTP server. Connectivity between the DLP cloud service and your SFTP server is successful if DLP cloud service successfully uploads the test file.
      The
      Connection Status
       displays whether the initial connection test was successful. Continue to the next step when the
      Bucket connected successfully
      .
      Click
      Previous
       if the connection isn’t successful to modify the SFTP server and connection settings as needed.
    7. Save
       the SFTP server connectivity settings.

    Recommended For You

    © 2024 Palo Alto Networks, Inc. All rights reserved.