Panorama

1. Log in to the Panorama web interface.

   An administrator with access privileges to create an admin role and commit to Panorama is required.
2. Select PanoramaAdmin Roles and Add a new admin role.

   If you want to modify an existing admin role, select that admin role instead of creating a new one. Only one admin role profile can be associated with an administrator account.
3. Configure the Enterprise DLP admin role.

   1. Enter a descriptive Name for the admin role.
   2. For the Role, select Panorama.
   3. In the Web UI, define the Enterprise DLP access privileges you want to grant the Panorama administrator.

      • MonitorLogsData Filtering—Access privileges to data filtering logs. You must Enable or give Read Only access to data filtering logs to allow the administrator to view Enterprise DLP incidents.

      • ObjectsCustom ObjectsData Patterns—Access privileges to Enterprise DLP data patterns.
      • ObjectsSecurity ProfilesData Filtering—Access privileges to Enterprise DLP data profiles.

      • DeviceSetup—To grant read and write access to the Enterprise DLP data filtering and Cloud Content settings, you must enable read and write access to the Content-ID tab and disable access for the remaining settings.

      • PanoramaPlugins—Access privileges to upgrade the Enterprise DLP plugin on Panorama and read and write access to the Enterprise DLP snippets settings.
        If you have other Panorama plugins installed, this will enable access to those configuration nodes in the Panorama tab as well.

   4. Configure any additional admin role access privileges as needed.

      For example, you can enable Push All Changes, CommitPanorama, and Tasks to allow the administrator to commit and push Enterprise DLP changes from Panorama to managed firewalls and then view the job status in the Task Manager.
   5. Click OK.
4. Create an Enterprise DLP administrator account.

   Skip this step if you modified an existing admin role already associated with an administrator account.

   1. Select PanoramaAdministrator and Add a new administrator.
   2. Enter a descriptive Name for the Enterprise DLP administrator account.
   3. Configure the authentication method for the administrator account using one of the following methods.

      • Enter the Password and Confirm Password.
      • Check (enable) Use Public Key Authentication and click Import Key to import the SSH key.
   4. For the Administrator Type, select Custom Panorama Admin.
   5. For the Profile, select the admin role you created in the previous step.
   6. Click OK.

5. Select CommitCommit to Panorama and Commit.
6. Verify the Enterprise DLP administrator account is correctly configured.

   In this example, access to the data filtering logs, data patterns, data profiles, and the plugin tabs are enabled.

   1. Log in to the Panorama web interface using the Enterprise DLP administrator account you created in the previous step.
   2. Select Monitor and confirm only the Data Filtering logs are displayed.
   3. Select ObjectsDLP and confirm that Data Filtering Profiles and Data Filtering Patterns are displayed and configurable.

      Custom Objects and Security Profiles are also displayed but the Enterprise DLP is not able to configure these.
   4. Select DeviceSetup and confirm only the Content-ID and DLP tabs are displayed and configurable.
   5. Select PanoramaDLP and confirm that the Enterprise DLP Configuration settings are displayed and configurable.
7. Continue based on your Enterprise DLP access privileges.

   • Enable Enterprise DLP on Panorama
   • Create a data pattern
   • Create a data profile
   • Monitor Enterprise DLP