Set Up Enterprise DLP End User Alerting with Cortex XSOAR for Microsoft Teams

Set up the prerequisites needed to begin integrating Microsoft Teams with
Cortex XSOAR
.
Create the Demisto Bot in Microsoft Teams.
Grant the Demisto Bot Permissions in Microsoft Graph.
Configure Microsoft Teams on Cortex XSOAR.
Add the Demisto Bot to a Team.
Integrate Microsoft Teams with
Cortex XSOAR
.
You can use one of the following methods based on your preferences.
Using Cortex XSOAR Rerouting
Using NGINX as Reverse Proxy
Using Apache Reverse Proxy and Cortex XSOAR Engine
Using Cloudflare
Create the API access token.
DLP app on the hub
Log in to the DLP app on the hub.
If you don’t already have access to the DLP app on the hub, see the hub Getting Started Guide. Only Superusers can access the hub.
Select
API
and
Create Token
.
Enter a descriptive
Token Name
and
Create
the access token.
Copy the
Access Token
and
Refresh Token
and save them in a secure location.
Prisma Access (Cloud Management)
Launch Prisma Access Cloud Management.

Select

Configuration

Security Services

Data Loss Prevention

Settings

API Tokens

and

Create Token

.

Enter a descriptive

Token Name

and

Create

the access token.

Copy the

Access Token

and

Refresh Token

and save them in a secure location.

The access and refresh tokens are displayed only once after initial creation and can’t be viewed again. If you lose the access or refresh tokens, you must create a new access token.


Enable
Enterprise DLP
on
Cortex XSOAR
.
On
Cortex XSOAR
, select
Marketplace
Browse
and search for
Enterprise DLP
.
Install
the
Enterprise DLP
content pack.
Select
Settings
Integrations
Instances
and search for
Enterprise DLP
.
Click
Add Instance
to integrate
Enterprise DLP
. See Integrate Enterprise DLP on XSOAR for more information.
Select a descriptive
Name
.
Add the
Access Token
and
Refresh Token
you created in the previous step.
Check (enable)
Long running instance
.
(
Optional
) Add any data profiles to exclude from End User Alerting.
Files that match data profiles added here aren’t offered block exemptions to the user who uploaded the file.
(
Optional)
Modify the automated
Teams Bot Message
Test
to confirm
Cortex XSOAR
has successfully integrated with
Enterprise DLP
.
A
Success
is displayed when
Cortex XSOAR
successfully integrates with
Enterprise DLP
.
Save & Exit
.
Confirm the
Cortex XSOAR
integration with
Enterprise DLP
.
Panorama (Next-Gen Firewalls) and Prisma Access (Panorama Managed)
Log in to the DLP app on the hub.
If you don’t already have access to the DLP app on the hub, see the hub Getting Started Guide. Only Superusers can access the hub.
Select
Settings
and check (enable)
Confirm the status for XSOAR Integration
.
Prisma Access (Cloud Management)
Launch Prisma Access Cloud Management.
Select
Manage
Configuration
Data Loss Prevention
Settings
Alerts
XSOAR Integration Setup
and check (enable)
Confirm the status for XSOAR Integration
.
Configure the End User Alerting with
Cortex XSOAR
exemption settings.
Select
Manage
Configuration
Data Loss Prevention
Settings
Alerts
Configuration
and configure the
Exemption Duration
.
The file that prompted the End User Alerting with
Cortex XSOAR
notification that was exempted can be uploaded for the duration of the exemption duration. The default is 12 hours.
Select
Manage
Configuration
Data Loss Prevention
Settings
Alerts
Configuration
and configure whether to
Include Snippets in Message
.
You can select
Off
(default) to not include a snippet of the sensitive data or
On
to include a snippet of the sensitive data in the automated message on Microsoft Teams.