Panorama

1. Log in to the Panorama web interface.
2. Select ObjectsDLPData Filtering Patterns.

   You don't need to select the device group associated with the managed devices that use Enterprise DLP. Enterprise DLP shares all data patterns across all device groups by default.
3. Add a new data pattern.
4. Specify a Name, Type, and criteria for the data pattern.

   Use any of the following data pattern types:

   • Regular Expression—Create regular expressions to use in the data pattern.
     You can choose Basic or Advanced data patterns. Use the Advanced data pattern to create a basic or weighted regular expression. With weighted regular expressions, you assign each text entry a score and when the score threshold is exceeded, such as when enough expressions from a pattern match an asset, Enterprise DLP indicates that the asset is a match for the pattern.
     Use the query builder in the Regular Expressions field to add Basic or weighted (Advanced) expressions.
     You can enter one or more Proximity Keywords to use with the data filtering pattern. Proximity keywords aren't case-sensitive and increase the probability that Enterprise DLP accurately detects a regular expression match. Proximity keywords impact the Enterprise DLP confidence level, which reflects the likelihood that matched traffic is accurately detected. Enterprise DLP determines the confidence level by inspecting the distance of regular expressions to proximity keywords.
     Data patterns that don't include proximity keywords to identify a match always have both Low and High confidence level detections in a DLP incident.
   • File Property—Add a file property pattern to match.
     If you use classification labels or embed tags in Microsoft Office and PDF documents for audit and tracking, you can create a file property data pattern that matches the metadata or attributes in the custom or extended properties of the file. Whether you use an automated classification mechanism, such as Titus, or require users to add a tag, you can specify a name-value pair to match on a custom or extended property embedded in the file.
     Enterprise DLP supports file property data patterns in Microsoft Office and PDF documents, including both the Object Linking and Embedding (OLE) format (.doc/.ppt) and the XML format (.docx/.pptx) of Microsoft Office.
     Add a Tag Name and Tag Value.
     A Tag Name and Tag Value are an associated pair that specifies the property to look for. For example, you can specify a Tag Name of Label and a Tag Value of Confidential. You can add as many file properties as you want. When you later reference the file property data pattern in a data filtering profile, Enterprise DLP uses a Boolean OR match in the match criteria.
     For files protected with Microsoft Azure Information Protection (AIP), you must enter the full AIP label Name that you want to take action on. The name can be either the MSIP_Label_<GUID>_Enabled label name or the Sensitivity label name.
5. Click OK to save the data pattern.
6. Commit and push the new configuration to your managed devices.

   The Commit and Push command isn't recommended for Enterprise DLP configuration changes. Using the Commit and Push command requires the additional and unnecessary overhead of manually selecting the impacted templates and managed devices in the Push Scope Selection.

   • Full configuration push from Panorama
     1. Select CommitCommit to Panorama, and then click Commit.
     2. Select CommitPush to Devices, and then click Edit Selections.
     3. Select Device Groups and Include Device and Network Templates.
     4. Click OK.
     5. Push your configuration changes to your managed devices that are using Enterprise DLP.
   • Partial configuration push from Panorama
     You must always include the temporary __dlp administrator when performing a partial configuration push. This is required to keep Panorama and Strata Cloud Manager in sync.

     For example, if the admin user is logged in and making changes, they must select both admin and __dlp in the partial commit and push.
     1. Select CommitCommit to Panorama.
     2. Select Commit Changes Made By and then click the current Panorama admin user to select additional admins to include in the partial commit.
        Select your logged-in admin user, the __dlp user, and any other admins whose changes you want to include. Click OK to continue.

     3. Commit.
     4. Select CommitPush to Devices.
     5. Select Push Changes Made By and then click the current Panorama admin user to select additional admins to include in the partial push.
        Select your logged-in admin user, the __dlp user, and any other admins whose changes you want to include. Click OK to continue.

     6. Select Device Groups and Include Device and Network Templates.
     7. Click OK.
     8. Push your configuration changes to your managed devices that are using Enterprise DLP.
7. Create a data profile on Panorama or Strata Cloud Manager.