Edit the Enterprise DLP Data Filtering Settings on Strata Cloud Manager

1. Log in to Strata Cloud Manager.
2. Select ConfigurationData Loss PreventionSettingsData Transfer and edit the Data Transfer settings.
3. Configure the File Based Settings.

   You can configure any of these settings. You must Save any changes to your file based settings for them to take effect and be enforced.

   • Max Latency (sec)—Maximum allowed time it takes for the enforcement point to forward a file to Enterprise DLP for inspection.
     For inspection of files greater than 20 MB, Palo Alto Networks recommends setting the max latency to greater than 60 seconds.
   • Action on Max Latency—Action the enforcement point takes if Enterprise DLP can't inspect and render a verdict on traffic matches because the time it takes to forward a file exceeds the Max Latency.
     Supported actions are Allow (default) or Block.
   • Max File Size (MB)—Enforce a maximum file size for forwarded files. Supports 1-100 MB.
     Prisma Browser supports 1-150 MB. Enterprise DLP.
   • Action on Max File Size—Action the enforcement point takes if the forwarded file exceeds the Max File Size.
     Supported actions are Allow (default) or Block.
   • Log Files Not Scanned—Enable this setting to generate a DLP incident when Enterprise DLP can't inspect a forwarded file for any reason.
4. Edit the Non-File Based Settings.

   You can configure any of these settings. You must Save any changes to your non-file based settings for them to take effect and be enforced.

   • Enable non-file based DLP—Enable this setting to prevent exfiltration of sensitive data in non-file format traffic for collaboration apps, web forms, cloud and SaaS apps, and social media on your network.
     You must enable this setting for Enterprise DLP to scan non-file based traffic and enforce all non-file based settings.
   • Max Latency (sec)—Maximum allowed time it takes for the enforcement point to forward non-file traffic to Enterprise DLP for inspection.
   • Action on Max Latency—Action the enforcement point takes if Enterprise DLP can't inspect and render a verdict on traffic matches because the time it takes to forward non-file traffic exceeds the Max Latency.
     Supported actions are Allow (default) or Block.
   • Min Data Size (B)—Enforce a minimum data size for forwarded non-file traffic.
     Enterprise DLP supports a minimum non-file traffic data size of 250 bytes.
   • Max Data Size (KB)—Enforce a maximum data size for forwarded non-file traffic.
     Enterprise DLP supports a maximum non-file traffic data size of 1-500 KB.
   • Action on Max Data Size—Action the enforcement point takes if Enterprise DLP can't inspect and render a verdict on traffic matches because the inspected non-file traffic exceeds the Max Data Size.
     Supported actions are Allow (default) or Block.
   • Log Files Not Scanned—Enable this setting to generate a DLP incident when Enterprise DLP can't inspect forwarded non-file traffic for any reason.
   • Enable WebSocket Inspection—Enable this setting to prevent exfiltration of sensitive data through WebSocket persistent streams. Review the supported apps to verify whether an app requires WebSocket inspection to be enabled.
5. In the DLP Settings, configure the Action on any Error to specify the action the enforcement point takes when any kind of error occurs that prevents Enterprise DLP from inspecting forwarded file or non-file traffic and rendering a verdict.

   This includes errors triggered when the enforcement point encounters traffic that falls outside configured thresholds, such as non-file traffic smaller than Min Data Size, files exceeding Max File Size (file), or non-file traffic exceeding the Max Data Size (non-file).

   • (Default) Allow—Allows the file or non-file traffic to continue to the intended destination when Enterprise DLP encounters an error.
   • Block—Blocks the file or non-file traffic when Enterprise DLP encounters an error.

   Click Save.
6. Push your data filtering settings.

   For the Admin Scope, select All Admins to ensure Enterprise DLP configuration changes propagate to all enforcement points.

   Enterprise DLP configuration changes don't display in Strata Cloud Manager config snapshots.

   1. Select ConfigurationNGFW and Prisma Access.
   2. Select Push Config and Push.
   3. Select the enforcement points you want to push to.
   4. Click Push.