Create a Data Filtering Profile on Panorama

Log in to the Panorama web interface.
(
Optional
) Create one or more Enterprise DLP data patterns.
Select
Objects
DLP
Data Filtering Profiles
and specify the
Device Group
.
Add
a new data filtering profile.
Configure the primary pattern for the data filtering profile.
If you select
Basic
, configure the following:
Primary Pattern
—
Add
one or more data patterns to specify as the match criteria.
If you specify more than one data pattern, the managed firewall uses a boolean OR match in the match criteria.
Match
—Select whether the pattern you specify should match (
include
) or not match (
exclude
) the specified criteria.
Operator
—Select aboolean operator to use with the
Threshold
parameter. Specify
Any
to ignore the threshold.
Threshold
—Specify a value to use with the
Operator
you specify.
For example, to match a pattern that appears three or more times in a file, select
more_than_or_equal_to
as the
Operator
and specify
3
as the
Threshold
.
Confidence
—Use this with the proximity keywords you specified in the data pattern you created. Specifying a confidence level of
Low
means that the managed firewall will not use proximity keywords. Specifying a Confidence level of
High
means that the managed firewall looks for the proximity keywords the first 200 characters of the regular expressions in the pattern before it considers the data pattern in a file to be a match.

If you select
Advanced
, you can create expressions by dragging and dropping data patterns,
Confidence
levels,
Operators
, and
Occurrence
values into the field in the center of the page.
Specify the values in the order that they are shown in the following screenshot (data pattern,
Confidence
, and
Operator
or
Occurrence
).

Select an
Action
(
Alert
or
Block
) to perform on the file.
If the data filtering profile has both Primary and Secondary Patterns, changing the data profile Action on Panorama deletes all Secondary Pattern match criteria.
Specify a
File Type
.
Leave the file type as
any
to match any of the supported file types.
Select
upload
as the
Direction
.
Downloads are not supported.
(
Optional
) Set the
Log Severity
recorded for files that match this rule.
The default severity is
Informational
.
Click
OK
to save your changes.
Attach the data filtering profile to a Security policy rule.
Select
Policies
Security
and specify the
Device Group
.
Select the Security policy rule to which you want to add the data filtering profile.
Select
Actions
and set the
Profile Type
to
Profiles
.
Select the
Data Filtering
profile you created previously.
Click
OK
to save your
Commit and push your configuration changes to your managed firewalls that are leveraging Enterprise DLP.
The
Commit and Push
command is not recommended for Enterprise DLP configuration changes. Using the
Commit and Push
command requires the additional and unnecessary overheard of manually selecting the impacted templates and managed firewalls in the Push Scope Selection.
Select
Commit
Commit to Panorama
and
Commit
.
Select
Commit
Push to Devices
and
Edit Selections
.
Select
Device Groups
and
Include Device and Network Templates
.
Click
OK
.
Push
your configuration changes to your managed firewalls that are leveraging Enterprise DLP.