Strata Cloud Manager

1. Log in to Strata Cloud Manager.
2. Use one of the various ways to access Identity & Access.
3. Add Access to your tenant where Enterprise DLP is active.

   This step is required only if the user for which you’re granting Enterprise DLP access isn’t already registered with the Palo Alto Networks Customer Support Portal (CSP).
4. Select System SettingsIdentity and Access ManagementRolesCustom Roles and click Add Custom Role to configure the custom role.

   You can use custom roles to define which permissions are enforced for your users and to provide more granular access control to Enterprise DLP than predefined roles.

   The access permissions applied to the Data Loss Prevention parent node determine the lowest access privilege you can assign to any of its child nodes. For example, if you want to provide No Access and Read Only to some areas of Enterprise DLP, you must first assign No Access to the Enterprise DLP application.

   Below is an example of a custom Enterprise DLP role. The custom role is configured with no access privileges to Audit Logs or any of the Enterprise DLP settings. However, read-only access is configured for the Health & Telemetry and DLP Incidents, and full read and write privileges are configured for Data Profiles, all Detection Methods, Document Types, and DLP Rules.

   • Enterprise DLP RBAC Mapping
     The mapping below maps the Enterprise DLP RBAC permissions to the Enterprise DLP configuration in Strata Cloud Manager.
     To grant a user access to the Data Risk and Data Asset Explorer dashboards, assign one of the predefined Enterprise DLP roles. You can't use a custom role to control access to these dashboards.
     • Audit Log—ConfigurationData Loss PreventionAudit Log
     • Data Profiles—ConfigurationData Loss PreventionData Profiles
     • Detection Methods—All detection methods in ConfigurationData Loss PreventionDetection Methods
       • Data Patterns—ConfigurationData Loss PreventionDetection MethodsData Patterns
       • Exact Data Matching—ConfigurationData Loss PreventionDetection MethodsExact Data Matching
       • Optical Character Recognition—ConfigurationData Loss PreventionDetection MethodsOptical Character Recognition
     • Health & Telemetry—ConfigurationData Loss PreventionHealth & Telemetry
     • Document Types—ConfigurationData Loss PreventionDocument Types
     • DLP Incidents—ConfigurationData Loss PreventionDLP Incidents
     • DLP Rules—ConfigurationData Loss PreventionDLP Rules
     • Settings—All Enterprise DLP settings in ConfigurationData Loss PreventionSettings
       • Alerts—ConfigurationData Loss PreventionSettingsAlerts
       • API Tokens—N/A; deprecated.
       • Data Filtering—N/A; deprecated.
       • Data Transfer—ConfigurationData Loss PreventionSettingsData Transfer
       • Sensitive Data—ConfigurationData Loss PreventionSettingsSensitive Data

5. Configure access privileges to allow a data security administrator to create End User Coaching notification templates.

   End User Coaching enables Enterprise DLP to display notifications to your end users when they generate an Enterprise DLP or Endpoint DLP incident. The end user notification template defines which DLP rules generate a notification and the contents of the notification.

   Select Prisma Access & NGFW ConfigurationManageObjects and configure the access privileges for User Coaching Notification Templates.

6. Assign role-based access for Enterprise DLP.

   You don’t need to configure a tenant role for a user if access to only Enterprise DLP is required.

   1. Select User and for the Identity Address, enter the email address for which you granted access in the previous step.
   2. For Apps & Services, select Enterprise DLP.
   3. Select a predefined or custom Enterprise DLP Role.
   4. Submit.
7. Continue based on your Enterprise DLP access privileges.

   • Enable Enterprise DLP on Strata Cloud Manager
   • Create a data pattern
   • Create a data profile
   • Monitor Enterprise DLP