End User Coaching

Contact your
Palo Alto Networks
representative to enable End User Coaching on your tenant.
Install the
GlobalProtect app
version 6.3 or later on Windows or macOS.
Log in to
Strata Cloud Manager
.
Enable
Autonomous DEM
.
In
App Settings
User Behavior
Digital Experience Management (DEM)
, you must configure these required settings to display notifications to your users in the Access Experience UI when they generate a DLP incident.
Enable
Autonomous DEM and GlobalProtect Log Collection for Troubleshooting
DEM for Prisma Access (Windows and Mac Only)
—Select
Install and User Cannot Enable or Disable DEM
DEM for Prisma Access version 6.3 and above (Windows and Mac Only)
—Select
Install the Agent
Configure
Enterprise DLP
.
Create a decryption profile and policy rule.
This is required for
Enterprise DLP
to decrypt and inspect traffic for sensitive data.
Create a decryption profile and policy rule.
This is required for
Enterprise DLP
to decrypt and inspect traffic for sensitive data.
Create custom data patterns to define your match criteria.
Alternatively, you can use the predefined data patterns instead of creating custom data patterns.
Create a data profile and add your data patterns.
Only custom data profiles are supported. By default, all predefined DLP Rules'
Action
are set to
Alert
. You must clone the predefined data profile to edit the DLP Rule
Action
.
Modify the DLP Rule.
When modifying the DLP Rule, you must set the
Action
to
Block
. This is required to generate alerts in the Access Experience UI. No alerts are displayed if the
Action
is set to
Alert
.
Add the DLP Rule to a Profile Group and attach the Profile Group to a Security policy rule. This is required for
Enterprise DLP
to generate a DLP incident which then generates a notification in the Access Experience UI.
Select
Manage
Configuration
NGFW and Prisma Access
Global Settings
User Coaching Notification Template
and create an End User Notification Template.
The end user notification template defines which DLP Rules generate a notification in the Access Experience UI and the contents of the notification. You should only add DLP Rules added to a Profile Group that is associated with a Security policy rule. This is required for
Enterprise DLP
to generate a DLP incident which then generates a notification in the Access Experience UI. A single DLP Rule can be added to multiple User Coaching Notification Templates.
The user who generated the
Enterprise DLP
incident can view the Data Security notification for more information about the sensitive data uploaded, downloaded, or posted.
A Data Security notification is displayed for 7 days. There is no limit to the number of notifications displayed.