Enterprise DLP Health and Telemetry

• Filters
  Filter all widgets in the Health & Telemetry dashboard using any combination of available filters.
  • Application—Select one or more apps. Enterprise DLP displays only the apps associated with forwarded traffic, and not all supported apps.
  • File Type—Select one or more file types. Enterprise DLP displays only the file types associated with forwarded traffic, and not all supported file types.
  • Channel—Select the enforcement channels. You can select NGFW, Endpoint DLP, Prisma Access, and Prisma Browser.
  • Region—Select one or more supported regions where forwarded traffic originated.
  • Content Type—Select the forwarded traffic content type. You can select File or Non-File.
  • Time Filter—Define the time frame for data displayed in the Health & Telemetry dashboard. You can select Past 15 Minutes, Past 60 Minutes, Past 3 Hours, Past 24 Hours, Past 7 Days, Past 30 Days, Past 60 Days, or Past 90 Days. Alternatively, you can define a Custom time frame.
• Transaction Summary Widgets
  The Transaction Summary widgets provide a high-level overview of traffic forwarded to Enterprise DLP.
  • Data Volume— Cumulative size of all file and non-file content forwarded to Enterprise DLP. This includes the full payload of files as well as the byte-count of non-file traffic, such as web form data or chat messages.
  • Request Volume—Total number of unique instances of file and non-file traffic forwarded to Enterprise DLP.
  • Completed—Total number of unique instances of forwarded traffic that Enterprise DLP successfully inspected that either contained no sensitive data or generated a DLP incident because Enterprise DLP detected sensitive data.
  • Errors—Total number of unique instances of forwarded traffic that Enterprise DLP failed to inspect due to a data, configuration, or service errors that prevented inspection.
  • Timeouts—Total number of unique instances of forwarded traffic that Enterprise DLP failed to complete because the session length to forward traffic exceeded the Max Latency settings configured in the data filtering settings.

• Transaction Throughput
  The Transaction Throughput is a line graph displaying the number of requests per second that were forwarded to Enterprise DLP over a specified time period. The requests signify the total number of unique instances of traffic forwarded to Enterprise DLP for inspection and verdict rendering.
  You can click the request status to remove it from the Transaction Throughout graph. Click the Download button to download the graph data in CSV or SVG format.
  The Transaction Throughput graphs depicts the total number of:
  • Completed requests.
    This is all requests that Enterprise DLP that contained no sensitive data or that Enterprise DLP blocked or generated an alert for because sensitive data was detected.
  • Requests that couldn't be completed due to Errors.
    In some cases, Enterprise DLP encounters data, configuration, or service errors that prevent inspection of forwarded traffic.
  • Requests that exceeded the Data Filtering Timeouts settings.
    You can configure the Max Latency settings to specify the maximum time allowed for the enforcement point to forward.

• Top 5 Transaction Widgets
  Enterprise DLP includes three Top 5 Transaction widgets allowing you to quickly see the most salient Enterprise DLP health and telemetry activity. The data displayed in the Top 5 Transactions widgets is based on the currently applied filters.
  • Top 5 Applications or File Types—View the top 5 Applications by App-ID or File Types. For the top apps or file types, you can view the list based on the total number of Completed inspections of forwarded traffic or the total number of Incidents generated.

  • Top 5 Data Profiles—View the top 5 data profiles that had sensitive traffic matches but experienced data, configuration, or service Errors or instances of session Timeouts that the prevented Enterprise DLP from successfully inspecting forwarded traffic and rendering a verdict.

  • Top 5 Failure Reasons—The top 5 reasons for Enterprise DLP inspection failures. Enterprise DLP lists the total count of each unique occurrence where Enterprise DLP failed to inspect forwarded traffic. This widget can display:
    • File is password protected or encrypted—Can't inspect password-protected files or encrypted files.
    • Unable to Read File—Enterprise DLP failed to inspect the forwarded file due to one of the following reasons:

      • File damaged and can't be inspected.
      • Unsupported file type forwarded. Enterprise DLP can only inspect supported File Types.
      • File content extraction failed.
    • Internal Scan Error—File content extraction and inspection failed due an internal error.