Enterprise DLP Incident Management
Focus
Focus
Enterprise DLP

Enterprise DLP Incident Management

Table of Contents


Enterprise DLP Incident Management

The Unified Incident Management and Response for Enterprise Data Loss Prevention (E-DLP) offers a powerful, unified solution for handling data security incidents across your organization.
On May 7, 2025, Palo Alto Networks is introducing new Evidence Storage and Syslog Forwarding service IP addresses to improve performance and expand availability for these services globally.
You must allow these new service IP addresses on your network to avoid disruptions for these services. Review the Enterprise DLP Release Notes for more information.
Where Can I Use This?What Do I Need?
  • NGFW (Managed by Panorama or Strata Cloud Manager)
  • Prisma Access (Managed by Panorama or Strata Cloud Manager)
  • Enterprise Data Loss Prevention (E-DLP) license
    Review the Supported Platforms for details on the required license for each enforcement point.
Or any of the following licenses that include the Enterprise DLP license
  • Prisma Access CASB license
  • Next-Generation CASB for Prisma Access and NGFW (CASB-X) license
  • Data Security license
The Enterprise Data Loss Prevention (E-DLP) Incident Management and Response dashboard combines AI-powered threat detection, customizable response workflows, and real-time collaboration tools to dramatically reduce incident response times and minimize the impact of security breaches in your organization. Furthermore, it enhances collaboration among different members of your security teams to allow for faster and more coordinated responses to data security incidents.
The Incident Management and Response dashboard provides a structured approach to data security incident handling by consolidating incidents across Enterprise DLP, Email DLP, Endpoint DLP, SaaS Security Inline, Data Security, and Prisma Access Browser. This allows your security administrators to aggregate and correlate data security incidents across your various enforcement channels to efficiently apply a consistent security posture. Furthermore, the Incident Management and Response dashboard allows your security administrators to validate adherence to your organization's regulatory compliance requirements by providing incident reports and audit trails.
With integrations across multiple data security channels, compliance reporting, and continuous improvement capabilities, the Incident Management and Response dashboard improves your overall security posture by allowing your security administrators to rapidly and effectively response to incidents to protect your organization's sensitive data and assets. Security administrators and SOC teams can assign, escalate, and collaborate on incidents effectively, with support for bulk incident response and automated prioritization. The detailed incident triage capabilities help you significantly reduce the mean time to detect and respond to threats. The Incident Management and Response dashboard streamline your security administrator's investigation process. It expedites response and remediation and integrates with third-party notification and ticketing systems so they can quickly respond to a data security incident and prevent them from happening again.


xThanks for visiting https://docs.paloaltonetworks.com. To improve your experience when accessing content across our site, please add the domain to the allow list on your ad blocker application.