Set up Evidence Storage on Strata Cloud Manager Using AWS

1. Review the setup prerequisites for Enterprise DLP and enable the required ports, full qualified domain names (FQDN), and IP addresses on your network.
2. Create a public S3 storage bucket to store files scanned by the Enterprise DLP cloud service.

   1. Log in to the Amazon AWS console.
   2. Select ServicesStorageS3Buckets and Create bucket.
   3. Enter a descriptive Bucket name.
   4. Select the AWS Region for the S3 storage bucket.
   5. In the Default encryption section, select Amazon S3 managed keys (SSE-S3) as the Encryption key type.

      You can Create a KMS Key if one does not already exist. Refer to AWS Documentation for more information on creating a new KMS key.

   6. Create bucket.
   7. Obtain the ARN for the S3 storage bucket.

      After creating the S3 storage bucket, you're redirected back to the Buckets page. Search for and click the storage bucket you created.

      Click Properties. The storage bucket ARN is displayed in the Bucket overview.
3. Enable the AWS KMS setting for the storage bucket and locate the trust relationship and access policy JSONs provided by Palo Alto Networks.

   1. Log in to Strata Cloud Manager.
   2. Select ManageConfigurationData Loss PreventionSettingsSensitive Data.
   3. In Evidence Storage, select Configure BucketAWS as the Public Storage Bucket.
   4. In Instructions - AWS, locate the trust relationship and access policy JSON provided to define the trust relationship and access policy between the IAM role and Palo Alto Networks.

      The first JSON provided is the trust relationship and the second is the access policy. Highlighted are the copy buttons that you will use later on to create the IAM role for the S3 storage bucket.

      Leave the Configure Bucket for Evidence Storage display open and continue to create the IAM role for the S3 storage bucket in a separate browser window.

4. Create the IAM role for the S3 storage bucket.

   This role is required to allow the DLP cloud service to write to the S3 storage bucket.

   1. Log in to the Amazon AWS console.
   2. Select ServicesSecurity, Identity, and ComplianceIAMAccess managementRoles and Create role.
   3. Select Custom trust policy.
   4. For the Trusted entity type, select Custom trust policy.
   5. Return to Strata Cloud Manager and copy the trust relationship JSON.
   6. In the Amazon AWS console, paste the trust relationship JSON into the Custom trust policy to configure the trust policy.

   7. Click Next.
   8. In Add permissions, select Create policyJSON.

      A new window is automatically opened in your browser to create the new access policy.
   9. Return to Strata Cloud Manager and copy the access policy JSON.
   10. In the Amazon AWS console, paste the access policy JSON into the Policy editor.
   11. Add the bucket ARN for the S3 storage bucket you created.

       Throughout the JSON, you must replace all instances of bucket_name_to_be_replaced with the S3 storage bucket ARN you created.

   12. Click Next.
   13. Enter a Policy name and Create policy.
   14. Return to the browser window where you're creating the IAM role,
   15. Search for and select the access policy you created.

   16. Click Next.
   17. Enter a descriptive Role name for the IAM role.
   18. Review the IAM role trust relationship and access policy.
   19. Create role.
5. Configure the S3 storage bucket for evidence file storage.

   1. Log in to Strata Cloud Manager.

      Access to evidence storage settings and files on Strata Cloud Manager is allowed only for an account administrator or app administrator role with Enterprise DLP read and write privileges. This is to ensure that only the appropriate users have access to report data and evidence.
   2. Select ManageConfigurationSecurity ServicesData Loss PreventionSettingsSensitive Data and select AWS as the Public Cloud Storage Bucket.
   3. Select Input Bucket Details.
   4. Enter the S3 Bucket Name of the bucket you created.

      The name you enter in the Strata Cloud Manager must match the name of the S3 storage bucket on AWS.
   5. Enter the Role ARN for the IAM role you created.

      The IAM Role ARN can be found in the IAM role Permissions. The role ARN is displayed in the Summary.
   6. Select the AWS Region where the bucket is located.

   7. Select Connect to verify the connections status your S3 storage bucket.

      Select Save if Enterprise DLP can successfully connect your bucket. A Palo_Alto_Networks_DLP_Connection_Test.txt file is uploaded to your storage bucket by the DLP cloud service to verify connectivity.

      If Enterprise DLP can't successfully connect your bucket, select Previous and edit the bucket connection settings.
6. Enable Sensitive Files for your enforcement points.

   You can enable evidence storage of sensitive files for Prisma Access, NGFW, and Endpoint DLP. Enable evidence storage when prompted to confirm.

7. Download Files for Evidence Analysis.