Enterprise DLP Migrator

1. Export your existing Symantec DLP policy rules in .xml format.
2. Log in to Strata Cloud Manager.
3. Select ConfigurationSaaS SecuritySettingsAll SettingsDLP Migration Assistant.
4. Upload the Symantec DLP policy rules to the Enterprise DLP Migrator.

   1. Enter a descriptive Migration Name for the Symantec DLP policy rule migration.
   2. In the Upload XML Files section, drag and drop the Symantec DLP policy rules files in .xml format.

5. Import the XML files you uploaded to the Enterprise DLP Migrator.

   Enterprise DLP begins to import and analyze your uploaded policy rules to verify compatibility. Continue to the next step once the import status reaches 100%.

6. Review your uploaded policy rules.

   Enterprise DLP lists the number of compatible, partially compatible, and incompatible policy rules from the total number of policy rules uploaded in the previous step.

   • Compatible—Policy rule is compatible with Enterprise DLP and is ready for migration. No further review required to prepare the policy rule for migration to Enterprise DLP.
   • Partially Compatible—Policy rule contains one or more traffic match criteria that are incompatible with Enterprise DLP. Review and delete the incompatible traffic match conditions before you can migrate the policy rule to Enterprise DLP.
   • Incompatible—All traffic match criteria in the policy rule are incompatible with Enterprise DLP. You can't migrate an incompatible Symantec DLP policy rule to Enterprise DLP.

   The Notes column displays the specific issue causing the traffic match incompatibility with Enterprise DLP.

7. Review and address your Partially Compatible policy rules.

   Skip this step if you want to only migrate Compatible rules and don't want to migrate any Partially Compatible policy rules.

   You can also select multiple Partially Compatible policy rules to review. If you select multiple policy rules, you must switch between them to address each policy rule individually.

   Enterprise DLP Migrator does not support turning an Incompatible policy rule into a Compatible policy rule.

   Below is an example of Partially Compatible Symantec DLP policy rules an admin might need review before migration to Enterprise DLP.

   1. Select one or more Partially Compatible policy rules you want to review.
   2. Review Selected.

   3. Select the Incompatible traffic match criteria and Delete.

      When prompted, confirm you want to Delete the selected incompatible traffic match criteria.

      If you selected multiple policy rules, use the navigation arrows in the top-right corner of the Review Policy page and repeat this step until you delete all incompatible traffic match criteria.

      After you delete all incompatible traffic match criteria from the selected Partially Compatible policy rules, click the X in the top-right corner to continue migration to Enterprise DLP.

   4. The policy rules now show that they are Compatible and Ready to Migrate.

8. Migrate one or more policy rules to Enterprise DLP.

   1. In the Review Policies page, select one or more policy rules and Migrate to PANW.
   2. Enterprise DLP displays a verification window detailing the number of Compatible policy rules selected for migration.

      Additionally, you can specify whether these policy rules are automatically Enabled after successful migration. By default, all migrated policy rules are Disabled.
   3. Migrate the selected policy rules.

   4. A progress bar displays the current policy rule migration progress.

9. Enterprise DLP displays a summary of the successfully migrated policy rules.

   Additionally, you can:

   • Export PDF—Export a PDF file of the policy rules you migrated to Enterprise DLP. You download the PDF to your local device.
   • Migration History—Redirected to the view the history of all previous successful policy rule migrations.
   • View Policies—Redirected to view your migrated policy rules in the SaaS Security Data Asset Policies to review and enable.

   Click View Policies to continue to the next step.

10. Review and enable your migrated policy rules.

    1. After a successful policy rule migration, click View Policies or select ConfigurationSaaS SecurityData SecurityPoliciesData Asset Policies.

       If you manually navigated to the SaaS Security Data Asset Policies, you also need to apply the Status: Disabled filter.
    2. Click the Policy Name to review the traffic match criteria and verify Enterprise DLP successfully migrated the policy rule.

       The Data Asset policy rule name is the same as the Symantec DLP policy rule XML file name you uploaded in the previous step. Enterprise DLP automatically populates the following Data Asset policy rule settings:

       • Description—Original Symantec DLP policy rule honored during migration and applied to the new Data Asset policy rule to preserve any important information and descriptions about the policy rule.

       • Data Profile—Enterprise DLP enables the Data Pattern/Profile match criteria and attaches the Data Profile created during the migration that contains all the traffic match criteria to the Data Asset policy rule.

       • Action—The SaaS Security equivalent of the Response Action from the Symantec DLP policy rule.

       You can edit the migrated Data Asset policy rule Policy Name or make any other changes as needed from this page. Click Save if you made any changes or Cancel if you reviewed the migrated policy rule match criteria and confirmed you don't need to make any changes.
    3. Expand the Action column and Enable the policy rule.
    4. Apply the Status: Enabled filter and order your policy rule as needed.

       Refer to the Recommendations for Security Policy Rules for more information on how to order your policy rules in your policy rulebase.
    5. Repeat this step for all migrated policy rules.