Set Up Enterprise DLP End User Alerting with Cortex XSOAR for Slack

Configure the platform on which you are leveraging Enterprise DLP to map IP addresses to email addresses.
This is required to leverage Enterprise DLP End User Alerting with Cortex XSOAR. If Panorama, Prisma Access (Panorama Managed), or Prisma Access (Cloud Managed) are not configured to map IP addresses to email addresses, Enterprise DLP cannot send automated messages using Slack.
Panorama (Next-Gen Firewalls)
Log in to the Panorama web interface.

Configure the Cloud Identity Engine as a Mapping Source on the Firewall.

When you configure the User Attributes, you must set the

Primary Username

as

Mail

.


Prisma Access (Panorama Managed)
- Get User and Group Information Using the Cloud Identity Engine
Prisma Access (Cloud Managed)
Launch Prisma Access Cloud Management.
Enable the Cloud Identity Engine.
Set up the Cloud Identity Engine.
Select
Manage
Configuration
Cloud Identity Engine
and edit the Cloud Identity Engine Settings.
For the Primary User Name, select
Mail
.
Configure the rest of the Cloud Identity Engine settings as needed.

Save
.
Enable Slack Integration with XSOAR.
Enable Mail Send Integration with XSOAR.
Create the API access token.
DLP app on the hub
Log in to the DLP app on the hub.
If you do not already have access to the DLP app on the hub, see the hub Getting Started Guide. Only Superusers can access the hub.
Select
API
and
Create Token
.
Enter a descriptive
Token Name
and
Create
the access token.
Copy the
Access Token
and
Refresh Token
and save them in a secure location.
Prisma Access (Cloud Managed)
Launch Prisma Access Cloud Management.

Select

Configuration

Security Services

Data Loss Prevention

Settings

API Tokens

and

Create Token

.

Enter a descriptive

Token Name

and

Create

the access token.

Copy the

Access Token

and

Refresh Token

and save them in a secure location.

The access and refresh tokens are displayed only once after initial creation and cannot be viewed again. If you lose the access or refresh tokens, you must create a new access token.


Enable Enterprise DLP on Cortex XSOAR.
On Cortex XSOAR, select
Marketplace
Browse
and search for Enterprise DLP.
Install
the Enterprise DLP content pack.
Select
Settings
Integrations
Instances
and search for
Enterprise DLP
.
Click
Add Instance
to integrate Enterprise DLP. See Integrate Enterprise DLP on XSOAR for more information.
Select a descriptive
Name
.
Add the
Access Token
and
Refresh Token
you created in the previous step.
Check (enable)
Long running instance
.
(
Optional
) Add any data profiles to exclude from End User Alerting.
Files that match data profiles added here are not offered block exemptions to the user who uploaded the file.
(
Optional)
Modify the automated
Slack Bot Message
Test
to confirm Cortex XSOAR has successfully integrated with Enterprise DLP.
A
Success
is displayed when Cortex XSOAR successfully integrates with Enterprise DLP.
Save & Exit
.
Confirm the Cortex XSOAR integration with Enterprise DLP.
Panorama (Next-Gen Firewalls) and Prisma Access (Panorama Managed)
Log in to the DLP app on the hub.
If you do not already have access to the DLP app on the hub, see the hub Getting Started Guide. Only Superusers can access the hub.
Select
Settings
and check (enable)
Confirm the status for XSOAR Integration
Prisma Access (Cloud Managed)
Launch Prisma Access Cloud Management.
Select
Manage
Configuration
Data Loss Prevention
Settings
Alerts
XSOAR Integration Setup
and check (enable)
Confirm the status for XSOAR Integration
.
Configure the End User Alerting with Cortex XSOAR exemption settings.
Select
Manage
Configuration
Data Loss Prevention
Settings
Alerts
Configuration
and configure the
Exemption Duration
.
The file that prompted the End User Alerting with Cortex XSOAR notification that was exempted can be uploaded for the duration of the exemption duration. The default is 12 hours.
Select
Manage
Configuration
Data Loss Prevention
Settings
Alerts
Configuration
and configure whether to
Include Snippets in Message
.
You can select
Off
(default) to not include a snippet of the sensitive data or
On
to include a snippet of the sensitive data in the automated message on Slack.