Enterprise DLP

Migrator

Export your existing Symantec DLP policy rules in

.xml

format.

Log in to

Strata Cloud Manager

.

Select

Manage

Configuration

SaaS Security

Settings

All Settings

DLP Migration Assistant

.

Upload the Symantec DLP policy rules to the

Enterprise DLP

Migrator.

Enter a descriptive
Migration Name
for the Symantec DLP policy rule migration.
In the
Upload XML Files
section, drag and drop the Symantec DLP policy rules files in
.xml
format.



Import

the XML files you uploaded to the

Enterprise DLP

Migrator.

Enterprise DLP

begins to import and analyze your uploaded policy rules to verify compatibility. Continue to the next step once the import status reaches

100%

.



Review your uploaded policy rules.

Enterprise DLP

lists the number of compatible, partially compatible, and incompatible policy rules from the total number of policy rules uploaded in the previous step.

Compatible
—Policy rule is compatible with
Enterprise DLP
and is ready for migration. No further review is needed to prepare the policy rule for migration to
Enterprise DLP
.
Partially Compatible
—Policy rule contains one or more traffic match criteria that are incompatible with
Enterprise DLP
. Review and delete the incompatible traffic match conditions before you can migrate the policy rule to
Enterprise DLP
.
Incompatible
—All traffic match criteria in the policy rule are incompatible with
Enterprise DLP
. The Symantec DLP policy rule can't be migrated to
Enterprise DLP
.

The

Notes

column displays the specific issue causing the traffic match incompatibility with

Enterprise DLP

.



Review and address your

Partially Compatible

policy rules.

Skip this step if you want to only migrate

Compatible

rules and don't want to migrate any

Partially Compatible

policy rules.

You can also select multiple

Partially Compatible

policy rules to review. If you select multiple policy rules, you must switch between them to address each policy rule individually.

Enterprise DLP

Migrator does not support turning an

Incompatible

policy rule into a

Compatible

policy rule.

Below is an example of

Partially Compatible

Symantec DLP policy rules that need to be reviewed before they can be migrated to

Enterprise DLP

.

Select one or more

Partially Compatible

policy rules you want to review.

Review Selected

.



Select the

Incompatible

traffic match criteria and

Delete

.

When prompted, confirm you want to

Delete

the selected incompatible traffic match criteria.

If you selected multiple policy rules, use the navigation arrows in the top-right corner of the

Review Policy

page and repeat this step until all incompatible traffic match criteria is deleted.

After you delete all incompatible traffic match criteria from the selected

Partially Compatible

policy rules, click the

X

in the top-right corner to continue migration to

Enterprise DLP

.



The policy rules now show that they are

Compatible

and

Ready to Migrate

.



Migrate one or more policy rules to

Enterprise DLP

.

In the

Review Policies

page, select one or more policy rules and

Migrate to PANW

.

A verification window is displayed detailing the number of

Compatible

policy rules are selected for migration.

Additionally, you can specify whether these policy rules are automatically

Enabled

after successful migration. By default, all migrated policy rules are

Disabled

.

Migrate

the selected policy rules.



A progress bar is displayed detailing the current policy rule migration status.



Your policy rules are now successfully migrated to

Enterprise DLP

.

A summary of the migration operation is displayed. Additionally, you can:

Export PDF
—Export a PDF file of the policy rules you migrated to
Enterprise DLP
. This PDF is downloaded to your local device.
Migration History
—Redirected to the view the history of all previous successful policy rule migrations.
View Policies
—Redirected to view your migrated policy rules in the
SaaS Security
Data Asset Policies
to review and enable.

Click

View Policies

to continue to the next step.



Review and enable your migrated policy rules.

After a successful policy rule migration, click

View Policies

or select

Manage

Configuration

SaaS Security

Data Security

Policies

Data Asset Policies

.

If you manually navigated to the

SaaS Security

Data Asset Policies

, you also need to apply the

Status: Disabled

filter.

Click the

Policy Name

to review the traffic match criteria and verify it was successfully migrated.

The Data Asset policy rule name is the same as the Symantec DLP policy rule XML file name you uploaded in the previous step. The following Data Asset policy rule settings are also automatically populated:

Description

—Original Symantec DLP policy rule honored during migration and applied to the new Data Asset policy rule to preserve any important information and descriptions about the policy rule.



Data Profile

—

Data Pattern/Profile

match criteria is selected and the

Data Profile

created during the migration that contains all the traffic match criteria is attached to the Data Asset policy rule.

Classic data profiles support predefined, custom, and file property data patterns only.

If you want to improve

Enterprise DLP

detection capabilities and accuracy with advanced detection methods, you must recreate the data profile as an advanced data profile or create a nested data profile. In either case, you must reattach the new data profile to the Data Asset policy rule.



Action

—The

SaaS Security

equivalent of the Response Action from the Symantec DLP policy rule.



You can edit the migrated Data Asset policy rule

Policy Name

or make any other changes as needed from this page. Click

Save

if you made any changes or

Cancel

if you reviewed the migrated policy rule match criteria and confirmed no changes are needed.

Expand the

Action

column and

Enable

the policy rule.

Apply the

Status: Enabled

filter and order your policy rule as needed.

Refer to the Recommendations for Security Policy Rules for more information on how to order your policy rules in your policy rulebase.

Repeat this step for all migrated policy rules.