View Enterprise DLP Log Details on Cloud Management

Launch the Cloud Management Console.
Select
Logs
DLP Incidents
.
Select a
Scan Date
and
Region
to filter the DLP Incidents.
Enterprise DLP
Incidents are generated in the
Region
where the Public Cloud Server is located.
For
Cloud Management
,
Enterprise DLP
automatically resolves to the closest Public Cloud Server to where the inspected traffic originated.
When a new Public Cloud Server is introduced,
Enterprise DLP
begins to automatically resolve to it if it’s closer to where the inspected traffic originated.
This might mean that new DLP Incidents generated after the release of a new Public Cloud Server are generated in a different
Region
.
Review the DLP Incidents summary information to help focus your incident investigation.
These lists are updated hourly.
Top Data Profiles to Investigate—
Lists up to seven data profiles with the highest number of incidents in descending order.
Top Sources to Investigate—
Lists up to seven source IP addresses and Fully Qualified Domain Names (FQDN) with the highest number of incidents in descending order.
Sensitive Files by Action—
Lists the number of incidents based on the Action taken by
Prisma Access (Cloud Management)
in descending order.
Review the Incidents and click a
File
name to review a specific incident.
You can filter the DLP incidents by
File Name
or
Report ID
to search for a specific incident you want to review.
Review the Incident Details to review specific file upload details.
Make note of the
Report ID
for the DLP incident if you haven’t already done so. The Report ID is used to view additional Traffic log details regarding the DLP incident.
Review the Matches within Data Profiles to review snippets of matching traffic and the data patterns that matched the traffic to better understand what data was detected.
For data profiles with nested data profiles created on the DLP app or Cloud Management, the data profile displayed is the specific nested data profile that matched the scanned traffic. For example, you create a
DataProfile
, with the nested profiles
Profile1
,
Profile2
, and
Profile3
and scanned traffic matches the nested
Profile2
and is blocked. In this scenario, the data profile displayed for the incident is
Profile2
.
Review the file log to learn about the traffic data for the DLP incident.
Select
Activity
Logs
Log Viewer
.
From the Firewall drop-down, select
File
.
Filter to view the file log for the DLP incident using the Report ID.
report_id=<report-id>
Review the file log to learn more about the traffic data for the DLP incident.
For example, you might want to review the application and source username to better understand where the DLP incident originated.
Manage Enterprise DLP Incidents on Cloud Management.