Set Up Enterprise DLP End User Alerting with Cortex XSOAR

Slack

1. Integrate your preferred IP address directory service using one of the following procedures.

   • Integrate AWS - Identity and Access Management
   • Integrate MSGraphAzure Users
   • Integrate Okta v2
   • Integrate PingOne
   • Integrate SailPoint IdentityIQ
   • Integrate SailPoint IdentityNow
2. Enable Slack Integration with XSOAR.
3. Enable Mail Send Integration with XSOAR.
4. Configure Enterprise DLP authentication.

   Expand all
   Collapse all
   • Strata Cloud Manager and Prisma Access (Managed by Panorama) (TSG-enabled)
     Access the Common Services Identity and & Access settings and add a Service Account to generate the Client ID and Client Secret.

     If you already have a Service Account created, you can Reset Client Secret to recover a lost Client Secret.

     The Client ID and Client Secret are used for authentication.

     When you create the Service Account, the Client ID and Client Secret are displayed in the Client Credentials. You can manually copy the Client Credentials or Download CSV File to download the Client Credentials in plaintext locally to your device.

     

   • Panorama (Not TSG-enabled)
     1. Log in to the DLP app on the hub.
        If you don’t already have access to the DLP app on the hub, see the hub Getting Started Guide. Only Superusers can access the hub.
     2. Select API and Create Token.
     3. Enter a descriptive Token Name and Create the access token.
     4. Copy the Access Token and Refresh Token and save them in a secure location.

     
5. Enable Enterprise DLP on Cortex XSOAR.

   Expand all
   Collapse all
   • Strata Cloud Manager and Prisma Access (Managed by Panorama) (TSG-enabled)
     1. Add the Client Credentials to Cortex XSOAR.

        1. On Cortex XSOAR, select SettingsIntegrationsCredentials and add a New credential.
        2. Enter a descriptive Credential Name.
        3. For the Username, enter the Client ID created in the previous step.
        4. For the Password, enter the Client Secret created in the previous step.
        5. Save.
     2. Select MarketplaceBrowse and search for Enterprise DLP.
     3. Install the Enterprise DLP content pack.
     4. Select SettingsIntegrationsInstances and search for Enterprise DLP.
        Click Add Instance to integrate Enterprise DLP. See Integrate Enterprise DLP on XSOAR for more information.
        1. Select a descriptive Name.
        2. For the Incident Type, verify Data Loss Prevention is selected.
           If Data Loss Prevention is not displayed, hover your mouse over the field to display the list of available incident types to search for and select Data Loss Prevention.
        3. for the Mapper, verify that Data Loss Prevention is selected.
           If Data Loss Prevention is not displayed, hover your mouse over the field to display the list of available incident types to search for and select Data Loss Prevention.
        4. Click Switch to credentials.
        5. Enter the Client Credentials generated in the previous step.
        6. Check (enable) Long running instance.
        7. (Optional) Modify the automated Slack Bot Message.
        8. Test to confirm Cortex XSOAR has successfully integrated with Enterprise DLP.
           A Success is displayed when Cortex XSOAR successfully integrates with Enterprise DLP.
   • Panorama (Not TSG-enabled)
     1. On Cortex XSOAR, select MarketplaceBrowse and search for Enterprise DLP.
     2. Install the Enterprise DLP content pack.
     3. Select SettingsIntegrationsInstances and search for Enterprise DLP.
        Click Add Instance to integrate Enterprise DLP. See Integrate Enterprise DLP on XSOAR for more information.
        1. Select a descriptive Name.
        2. For the Incident Type, verify Data Loss Prevention is selected.
           If Data Loss Prevention is not displayed, hover your mouse over the field to display the list of available incident types to search for and select Data Loss Prevention.
        3. for the Mapper, verify that Data Loss Prevention is selected.
           If Data Loss Prevention is not displayed, hover your mouse over the field to display the list of available incident types to search for and select Data Loss Prevention.
        4. Add the Access Token and Refresh Token you created in the previous step.
        5. Check (enable) Long running instance.
        6. (Optional) Modify the automated Slack Bot Message.
        7. Test to confirm Cortex XSOAR has successfully integrated with Enterprise DLP.
           A Success is displayed when Cortex XSOAR successfully integrates with Enterprise DLP.
6. Configure the DLP Incident Feedback Loop Cortex XSOAR playbook

   1. In Dashboard & Reports, select Playbooks.
   2. Select DLP Incident Feedback LoopsPlaybook Triggered.
   3. Configure the Cortex XSOAR playbook.

      • For ApprovalTarget, enter Manager to send an exemption request to the sender's manager. This information is pulled from your preferred IP address directory service.
      • For the UserMessageApp, verify Slack is displayed.
      • For the ApproverMessageApp, enter Slack.
      • (Optional) For the DenyMessage, enter a custom response when a file extension is denied by the sender's manager,
   4. Save.

   
7. Confirm the Cortex XSOAR integration with Enterprise DLP.

   Expand all
   Collapse all
   • Strata Cloud Manager andPrisma Access (Managed by Panorama) (TSG-enabled)
     1. Log in to Strata Cloud Manager.
     2. Select ManageConfigurationData Loss PreventionSettingsAlertsXSOAR Integration Setup and check (enable) Confirm the status for XSOAR Integration.
   • Panorama (Not TSG-enabled)
     1. Log in to the DLP app on the hub.
        If you don’t already have access to the DLP app on the hub, see the hub Getting Started Guide. Only Superusers can access the hub.
     2. Select Settings and check (enable) Confirm the status for XSOAR Integration.
8. Configure the End User Alerting with Cortex XSOAR exemption settings.

   1. Select ManageConfigurationData Loss PreventionSettingsAlertsConfiguration and configure the Exemption Duration.

      The file that prompted the End User Alerting with Cortex XSOAR notification that was exempted can be uploaded for the duration of the exemption duration. The default is 12 hours.
   2. Select ManageConfigurationData Loss PreventionSettingsAlertsConfiguration and configure whether to Include Snippets in Message.

      You can select Off (default) to not include a snippet of the sensitive data or On to include a snippet of the sensitive data in the automated message on Slack.