Download Files for Evidence Analysis
Focus
Focus
Enterprise DLP

Download Files for Evidence Analysis

Table of Contents

Download Files for Evidence Analysis

Download files that match your Enterprise Data Loss Prevention (E-DLP) data profiles for investigative analysis.
Where Can I Use This?What Do I Need?
  • Panorama
  • Strata Cloud Manager
  • Enterprise Data Loss Prevention (E-DLP) license
  • (SaaS Security only) SaaS Security license
  • (Panorama) Device management license
  • (Panorama) Support license
  • (Strata Cloud Manager) Prisma Access license
  • (Strata Cloud Manager) AIOps for NGFW Premium license
  • (Strata Cloud Manager) AIOps for NGFW Free license
After you successfully connect your AWS storage bucket, Azure storage bucket, or SFTP server to Enterprise Data Loss Prevention (E-DLP) to store evidence for traffic that match your Enterprise DLP data profiles, you can download a file to your local device the instance of traffic scanned by the DLP cloud service that generated the DLP incident to allow for in-depth investigation.
Traffic scanned by the DLP cloud service while Enterprise DLP is disconnected from your cloud storage bucket isn't stored in your cloud storage. This means that all files created by traffic that generated a DLP incident aren’t available for download. However, all snippet data is preserved and can still be viewed in Enterprise DLP.
The file format or the matched traffic is dependent on the type of traffic that generated the DLP incident.
  • File Based—Copy of the file that generated the incident is saved in the same file format in which it was inspected.
  • Non-File—Non-file traffic is saved in .txt format.
    If a file is shared in a non-file based app, for example Slack, then the file is saved in the same file format in which it was inspected.
  • Email DLP—Outbound emails are saved in .eml format.

Strata Cloud Manager

Download files that match your Enterprise Data Loss Prevention (E-DLP) data profiles for Prisma Access (Managed by Strata Cloud Manager) and SaaS Security on Strata Cloud Manager.
  1. Connect your AWS storage bucket, Azure storage bucket, or SFTP server to Enterprise DLP if not already connected.
    The files available to download are only files scanned by the DLP cloud service after you successfully connected Enterprise DLP to your cloud storage bucket.
  2. (AWS and Azure only) Log in to the Amazon AWS console or Microsoft Azure portal and access the cloud storage you connected to Strata Cloud Manager. Select Reports and enter a Report ID to Search.
    The object Name is the Report ID.
  3. Log in to Strata Cloud Manager.
  4. In the Cloud Management Console, select ManageConfigurationData Loss PreventionDLP Incidents and search for the Report ID.
  5. Review report summary and click the download button to download the file to your device.
    Whether the stored file is downloaded directly to your local device is dependent on the storage bucket you connected to Enterprise DLP.
    • AWS and Azure—The file associated with the particular Report ID is downloaded locally to your device.
    • SFTP ServerCloud Management displays the folder path of the location the file was uploaded to on your SFTP server. You must access your SFTP server to download the file to your local device.

Panorama

Download files that match your Enterprise Data Loss Prevention (E-DLP) data filtering profiles on the Panorama™ management server and Prisma Access (Managed by Panorama).
  1. Connect your AWS storage bucket, Azure storage bucket, or SFTP server to Enterprise DLP if not already connected.
    The files available to download are only files scanned by the DLP cloud service after you successfully connectedEnterprise DLP to your cloud storage.
  2. (AWS and Azure only) Obtain the Report ID for the file you want to download by doing one of the following:
    • Log in to the Amazon AWS console or Microsoft Azure portal and access the storage bucket you connected to Enterprise DLP. Select Reports and enter a Report ID to Search.
      The object Name is the Report ID.
    • Log in to the Panoramaweb interface and select MonitorLogsData Filtering and Filter the data filtering logs by entering ( subtype eq dlp ). Locate the Report ID column to obtain the Report ID for the report you want to download.
  3. Log in to the DLP app on the hub.
    If you don’t already have access to the DLP app on the hub, see the hub Getting Started Guide. Only Superusers can access the hub.
  4. Select Reports and enter a Report ID to Search.
  5. Review report summary and click the download button to download the file to your device.
    Whether the stored file is downloaded directly to your local device is dependent on the storage bucket you connected to Enterprise DLP.
    • AWS and Azure—The file associated with the particular report ID is downloaded locally to your device.
    • SFTP ServerEnterprise DLP displays the folder path of the location the file was uploaded to on your SFTP server. Access your SFTP server to download the file to your local device.