Create and Upload an Encrypted EDM Data Set Using a Configuration File

Table of Contents

Upload an Encrypted EDM Data Set to Enterprise DLP

Create and Upload an Encrypted EDM Data to Enterprise DLP in Interactive Mode

Create and Upload an Encrypted EDM Data Set Using a Configuration File

Use the Exact Data Matching (EDM) CLI app to create and upload an encrypted hash EDM data set in CSV or TSV format using a configuration file.

On May 7, 2025, Palo Alto Networks is introducing new Evidence Storage and Syslog Forwarding service IP addresses to improve performance and expand availability for these services globally.

You must allow these new service IP addresses on your network to avoid disruptions for these services. Review the Enterprise DLP Release Notes for more information.

Where Can I Use This?	What Do I Need?
NGFW (Managed by Panorama or Strata Cloud Manager) Prisma Access (Managed by Panorama or Strata Cloud Manager) Prisma Browser	Enterprise Data Loss Prevention (E-DLP) license Review the Supported Platforms for details on the required license for each enforcement point. Or any of the following licenses that include the Enterprise DLP license Prisma Access CASB license Next-Generation CASB for Prisma Access and NGFW (CASB-X) license Data Security license

Where Can I Use This?

What Do I Need?

NGFW (Managed by Panorama or Strata Cloud Manager)
Prisma Access (Managed by Panorama or Strata Cloud Manager)
Prisma Browser

Enterprise Data Loss Prevention (E-DLP) license
Review the Supported Platforms for details on the required license for each enforcement point.

Or any of the following licenses that include the Enterprise DLP license

Prisma Access CASB license
Next-Generation CASB for Prisma Access and NGFW (CASB-X) license
Data Security license

Create and upload an encrypted hash Exact Data Matching (EDM) data set using a configuration file included with the EDM CLI app. The configuration file allows you to configure the upload parameters for upload ahead of time rather than manually entering each parameter at the time of upload. You can also quickly update an existing EDM data set on Enterprise DLP when you configure the config.properties and upload_config.properties files.

Set Up the EDM CLI App.
Create a Service Account for EDM Dataset Uploads.

You must provide the service account Client ID and Client Secret to successfully authenticate the EDM CLI app and upload EDM datasets.

(EDM CLI app 6.0 and later) If you encrypted your Client ID and Client Secret, you must provide the 32-byte AES encryption key for each to successfully authenticate the EDM CLI app and upload EDM datasets.
Configure EDM CLI App Connectivity to Enterprise DLP.
In the upload_config.properties file, you must enter a unique data set name for EDM data set you want to create and upload as the dataset_name. Upload to Enterprise DLP fails if you upload an EDM data set with a data set name that already exists.
Review the Supported EDM Data Set Formats and prepare the EDM data set for upload to Enterprise DLP.
Navigate to the package-edm-secure-cli-<version>-<platform> directory and open the config.properties file.
Configure the EDM data set upload parameters.
1. Enter the path of the EDM data set for upload.
2. Enter the delimiter used to specify boundaries between values in the EDM data set.
  Enterprise DLP supports the “,” and tab (t) delimiters for EDM data set uploads. An EDM data set can only use one delimiter.
3. Enter the EDM data set encoding method.
4. Enter the error threshold percentage for the EDM data set.
  The EDM CLI app does not create an encrypted version of the EDM data set if it encounters errors exceeding the specified error threshold percentage.
5. Specify whether the EDM data set has a header row.
  Enter true if the EDM data set includes a header row.
  Enter false if the EDM data set does not include a header row.
6. Specify whether to allow uploads of EDM data sets that include empty or blank cells.
  
  Enter true to allow rows that include empty or blank rows in an EDM data set.
  
  Enter false to reject rows that include empty or blank cells in an EDM data set.
7. Specify whether the EDM CLI app should abort the EDM data set upload if the EDM data set includes more than the maximum number of cells supported.
  
  Enter true to upload the maximum number of data set cells supported.
  
  Enter false to abort EDM CLI app if the EDM data set has more than the maximum number of data set cells supported.
8. Map your columns using the supported Data Types Value to accurately map each column in your EDM data set to a specific Data Type.
  Refer to the README.txt file packaged with the EDM CLI app for the table to map your EDM data set columns to the correct Data Type value.
  
  When you create a data profile on Strata Cloud Manager, you’re required to add at least one column where the column values occurs up to 12 times in the selected EDM data set for the Primary Field.
  When mapping your columns to a specific Data Type, be sure to include at least one column with up to 12 occurrences across the entire EDM data set. Otherwise, Enterprise DLP is unable to match traffic against the EDM data profile you create using this EDM data set.
9. Select File and Save the configuration file.
Upload the EDM data set to Enterprise DLP.
1. Open a terminal and navigate to the package-edm-secure-cli-<version>-<platform> directory where the EDM CLI app is located.
2. Upload the EDM data set to Enterprise DLP.
  All Versions
  Windows
  admin:edm-secure-cli.bat create -u
  
  Linux
  admin:./edm-secure-cli.sh create -u
  Encrypted using EDM CLI App 6.0 or Later
  Windows
  admin: edm-secure-cli.bat create -u --key /path/to/folder/<key-name>.key
  
  Linux
  admin:./edm-secure-cli.sh create -u --key /path/to/folder/<key-name>.key
  
  The EDM CLI app creates a secured copy of the EDM data set and the EDM data set begins uploading to Enterprise DLP.
3. Verify that the EDM data set uploaded successfully to Enterprise DLP.
  
  The EDM CLI app displays a progress bar and success message to notify you whether the upload is successful.
  
  During the upload process, the EDM CLI app connects to Enterprise DLP to verify that you created the output.zipfile using a supported EDM CLI app version. The upload to Enterprise DLP fails if you created the output.zip file using an unsupported EDM CLI app version.
Monitor the upload status of the EDM data set.
The time it takes for an EDM data set uploaded to Enterprise DLP to be available on Strata Cloud Manager depends on the EDM data set size and internet connectivity speed. For example, a 4GB EDM data set upload typically takes about 30 minutes to display on Strata Cloud Manager and be usable in a data profile.
1. Log in to Strata Cloud Manager.
2. Select ConfigurationData Loss PreventionDetection MethodsExact Data Matching.
3. The EDM data set upload is complete when the Indexing Status column displays Complete.