Platform Support

• Only a Superuser on Panorama can create Enterprise DLP patterns and profiles, and can associate profiles to Security policy rules for tenants.
• A Superuser must commit all changes to Panorama whenever they make changes to patterns and profiles.
• All tenants share a single copy of pattern and profile configurations; therefore, Enterprise DLP synchronizes any changes done you make across all your tenants where you activated Enterprise DLP.
• Since Security policy rules can be different across tenants, each tenant can have different data profiles associated with Security policy rules.

• NGFW and VM-Series (Managed by Panorama)
  PA-410, PA-415, and PA-415-5G firewalls are not supported.
  • NGFW PAN-OS Version—PAN-OS 10.0.2 or a later version.
  • Panorama PAN-OS Version—M-Series or virtual appliance running PAN-OS 10.0.2 or later version.
    To successfully use Enterprise DLP, you must configure your Security policy rule and Security Profile Group on Panorama and push these configurations to your managed firewalls.
    Enterprise DLP does not support pushing an Enterprise DLP data filtering profile to your managed firewall and referencing the data filtering profile in a Security policy rule or Security Profile Group created locally on the firewall.
  • Apps & Threats Content Update Version—Application and Threats content release version 8334 or a later version.
    Upgrade to PAN-OS 10.0.3 and install Application and Threats content release version 8413 or later version for additional application support.
  • Licenses—Support licenses (NGFW and Panorama) and a Panorama device management license.
• Prisma Access (Managed by Panorama)
  • Prisma Access Version—Prisma Access 2.0 Innovation or a later version.
  • PanoramaPAN-OS Version—M-Series or virtual appliance running PAN-OS 10.0.2 or later version.
    To successfully use Enterprise DLP, you must configure your Security policy rule and Security Profile Group on Panorama and push these configurations to your managed firewalls.
    Enterprise DLP does not support pushing an Enterprise DLP data filtering profile to your managed firewall and referencing the data filtering profile in a Security policy rule or Security Profile Group created locally on the firewall.
  • Apps & Threats Content Update Version—Application and Threats content release version 8334 or a later version.
    Install Application and Threats content release version 8413 or later version for additional application support.
  • Licenses—Prisma Access license, Strata Logging Service license, and Panorama support license.
• NGFW and VM-Series (Managed by Strata Cloud Manager)
  PA-410, PA-415, and PA-415-5G firewalls are not supported.
  • Review the list of NGFW supported on Strata Cloud Manager.
  • NGFW PAN-OS Version—PAN-OS 10.2.3 or a later version.
  • Apps & Threats Content Update Version—Application and Threats content release version 8614 or a later version.
  • Licenses—NGFW support license and a AIOps for NGFW Premium license.
• Prisma Access (Managed by Strata Cloud Manager)
  • Enterprise DLP is an add-on license for Prisma Access when using Strata Cloud Manager from a Single Prisma SASE Platform or Multitenant Prisma SASE Platform.
    However, the CASB-X and CASB-PA licenses include the Enterprise DLP license by default and does not require a separate license to activate and use Enterprise DLP.
  • Important: Install the Panorama plugin for Enterprise DLP 1.0.6 or later release if you’re using Enterprise DLP on both NGFW and Prisma Access (Managed by Strata Cloud Manager) and NGFW and Prisma Access (Managed by Panorama).
    This is required to ensure Enterprise DLP configurations are successfully synchronized across both Strata Cloud Manager and Panorama.

Applications

• Any application that supports the Non-File Inspection Inspection Type requires PAN-OS 10.2.3 or later PAN-OS release.
• Any application that supports a Max File Size larger than 20 MB requires PAN-OS 10.2.4 or later PAN-OS 10.2 release, or PAN-OS 11.0.2 or later release.
• Any application that supports the Download Direction requires PAN-OS 10.2.4 or later PAN-OS 10.2 release, or PAN-OS 11.0.2 or later release.
• To upgrade Panorama or Strata Cloud Manager.

  • For Panorama, upgrade Panorama and managed firewalls to the Minimum Version Requirement or later release.
  • For Prisma Access (Managed by Panorama), you must upgrade Panorama to the Minimum Version Requirement and ensure your Prisma Access tenants are running the Minimum Version Requirement or later release.
  • For Cloud Management, a PAN-OS software upgrade in the Strata Cloud Manager infrastructure to the Minimum Version Requirement or later release is required. You can view the Software Version in the Strata Cloud Manager Overview.
  • Review the Compatibility Matrix for the minimum plugin versions required for your target upgrade version.

To use Gmail, you must disable the Quick UDP Internet Connection (QUIC) protocol. Palo Alto Networks recommends that you disable QUIC in Chrome. To do so, specify chrome://flags/ in the Chrome Experimental QUIC Protocol, and select Disabled.

GenAI Applications

• All GenAI app support require PAN-OS 10.2.3 or later release.
• All GenAI apps support only non-file inspection unless otherwise specified.
• For App-IDs delivered through dynamic content updates, the App-ID refers to the container App-ID for the GenAI app. Refer to the Palo Alto Networks Applipedia for the full list of child App-IDs.

File Types

• File Name Characters—File name up to 64 bytes in length are supported.
• File Operations—You can upload and download files using HTTP and HTTPS (no FTP or SMTP) using:
  • (DLP 3.0.1 and earlier releases) HTTP/1.1
    Some applications, such as SharePoint and OneDrive, use HTTP/2 by default. To use HTTP/2 files with HTTP/1.1, you need to create a decryption profile and a Security policy rule to strip out the application-layer protocol negotiation (ALPN) extension in headers. See enable Enterprise DLP for more information.
  • (DLP 3.0.2 and later releases) HTTP/1.1 and HTTP/2
• File Size—The maximum supported file size is dependent on the application. Review the supported applications for more information.
• Data Flow—File uploads and downloads are supported. Review the supported applications to learn the data flow direction supported for each application.
  Enterprise DLP doesn’t support maintaining a session connection to continue inspection if a file download is paused. The DLP cloud service inspection is terminated for the file if the download operation is paused.
• Concurrent File Uploads—25 concurrent file uploads are supported.
• File Types—Enterprise DLP supports inspection of the following file types.
  • Microsoft Office (.doc, .docx, .ppt, .pptx, .xls, .xlsx)
  • Microsoft Visio (.vsd, .vsdm, .vsdx)

    Requires Application and Threats content release 8656-7766 or later versions installed on Panorama and managed firewalls, or Strata Cloud Manager deployment.
  • .csv
  • .pdf
  • .rtf
  • .tsv
  • .txt
• Image File Types—Enterprise DLP supports extraction and inspection of the following image file types using Optical Character Recognition (OCR).

  • .jpg
  • .jpeg
  • .png
  • .tif
  • .tiff
• Source Code File Formats—Enterprise DLP supports inspection of the following source code file formats.
  • Cfamily—C, C++, C+, C#, Objective C
  • Go
  • HTML
  • java
  • javascript
  • JSON
  • perl
  • powershell
  • python
  • r
  • ruby
  • vbs
  • verilog
  • vhd1
  • x86_assembly
• ZIP Files—Enterprise DLP supports inspection of ZIP and 7Z (7-ZIP file archiver) files containing the supported file types listed above.
  Enterprise DLP supports multilevel compressed files.

  • Prisma Access and NGFW (Managed by Panorama or Strata Cloud Manager)—Up to four levels of file compression is supported. The total file size for all uncompressed files may not exceed the maximum supported file size for each application.
  • Data Security—No maximum number of file compression levels. The total file size for all uncompressed files may not exceed the maximum supported file size for each application.
• Response—Block and Alert actions are supported for HTTP and HTTPS files. However, the Block page doesn’t display the name of the file that the managed firewall blocked.

Encoding Schemas

• Base64
• Big5
• EUC-JP
• EUC-KR
• GB18030
• IBM855
• ISO-2022-CN
• UISO-2022-JP
• ISO-2022-KR
• ISO-8599-1
• ISO-8599-2
• ISO-8599-3
• ISO-8599-4
• ISO-8599-5
• ISO-8599-6
• ISO-8599-7
• ISO-8599-8
• ISO-8599-9
• ISO-8599-11
• ISO-8599-12
• ISO-8599-13
• ISO-8599-15
• KOI8-R
• Shift_JIS
• UTF-8
• UTF-16BE
• UTF-16LE
• windows-1251
• windows-1252
• windows-1253
• windows-1255

Detection Methods

Features

Double Byte Characters

• Chinese (simplified)
• Chinese (traditional)
• Korean
• Japanese

• Supported

  Category	Supported
  Channel	Prisma Access (Managed by Strata Cloud Manager) SaaS Security (API and Inline) Email DLP
  File Types	.csv .pdf .txt Microsoft Office (.doc, .docx, .ppt, .pptx, .xls, .xlsx) ZIP files
  Detection Methods	Predefined and custom regular expression (regex) data patterns Predefined and custom file property data patterns Data Dictionaries

• Not Supported

  Category	Not Supported
  Channel	NGFW (Managed by Panorama) NGFW (Managed by Strata Cloud Manager)
  File Types	Microsoft Visio (.vsd, .vsdm, .vsdx) Image files (.jpg, .jpeg, .png, .tif, .tiff) All source code file types
  Detection Methods	Custom Document Types Exact Data Matching (EDM) Optical Character Recognition (OCR) Titus tags for file property data patterns (SaaS Security API and Inline) Regex data patterns for PDF files

Non-File Based Traffic