Set Up End User Coaching for Enterprise DLP

1. Review the Setup Prerequisites for End User Coaching to ensure you are running the minimum required agent, endpoint software, and Enterprise DLP plugin versions to display notifications.
2. Install the GlobalProtect app or Prisma Agent.

   • GlobalProtect—App version 6.2.7 or later on Windows or macOS
   • Prisma Agent—Install the Prisma Agent on Windows or macOS
3. Log in to Strata Cloud Manager.
4. Enable Autonomous DEM.

   • GlobalProtect
     (GlobalProtect only) Select ConfigurationNGFW & Prisma AccessConfiguration ScopeGlobalProtectGlobalProtect App and click Add App Settings. Configure the required settings to display notifications to your users in the Access Experience UI when they generate a DLP incident.
     (GlobalProtect and Prisma Agent) Select ConfigurationNGFW & Prisma AccessConfiguration ScopeAccess AgentGlobalProtect App and click Add App Settings. Configure the required settings to display notifications to your users in the Access Experience UI when they generate a DLP incident.
     Configure the following required App Configuration settings. Configure the rest of the GlobalProtect settings as needed.
     • Enable Autonomous DEM and GlobalProtect Log Collection for Troubleshooting.

     • Select Show Advanced OptionsApp and enable Display ADEM Updates Notification Message.

     • Select Show Advanced OptionsUser Behavior and for the DEM for Prisma Access (Windows and Mac Only) setting, select Install and User Can’t Enable or Disable DEM.
     • Select Show Advanced OptionsUser Behavior and for the DEM for Prisma Access version 6.3 and above (Windows and Mac Only) setting, select Install the Agent.

   • Prisma Agent
     Select ConfigurationNGFW & Prisma AccessConfiguration ScopeAccess AgentPrisma Agent and click Add Agent Settings. Configure the required settings to display notifications to your users in the Access Experience UI when they generate a DLP incident.
     Configure the following required App Configuration settings. Configure the rest of the Prisma Agent settings as needed.
     • Access Experience—Select Install.
     • Display ADEM Update Notification—Select Enable.

5. (macOS only) In the Access Experience UI, select SettingsNotifications and enable Allow notifications.

   You must enable this setting in the Access Experience UI for each user. It is required to display notifications when the user generates a DLP incident. Configure the rest of the Access Experience notifications settings as needed.
6. Configure Enterprise DLP.

   1. Create a decryption profile and policy rule.

      Enterprise DLP requires a decryption rule to decrypt and inspect traffic for sensitive data.
   2. Create custom data patterns to define your match criteria.

      Alternatively, you can use the predefined data patterns instead of creating custom data patterns.
   3. Create a data profile and add your data patterns.

      Only custom data profiles are supported. The default Action for all predefined DLP rules is Alert. You must clone the predefined data profile to edit the DLP rule Action.
7. Create or modify a Network DLP notification template.

   A notification template defines the format of the coaching notification that end users receive when they generate an incident. Using the template, you can specify the contents of the notification message for sensitive file or non-file upload or download actions. You can also enable localization in the template to send notifications in each user’s preferred language.

   1. Log in to Strata Cloud Manager.
   2. Select ConfigurationEnd User Coaching.

      The End User Coaching page lists the available notification templates. The Product Type column identifies the available Network DLP templates, including the default Network DLP template. You can edit any of these templates, create a new template, or copy a template as a starting point for a new one.
   3. On the End User Coaching page, complete one of the following actions:

      • To create a new notification template, click Create New.
      • To copy a notification template as a starting point for a new template, locate the template in the list and, from the Actions column, click the copy icon.
      • To edit a notification template, locate the template in the list and, from the Actions column, click the edit icon.
   4. Edit the fields of the notification template.

      1. In Template Name and Template Description, enter a name and a description that explains the purpose of the notification.
      2. For Product Name, choose NETWORK_DLP.
      3. (Optional) If you want the message to display in the end user's preferred language, complete the following steps.
         1. Enable Allow for Language Localization.
         2. Select the languages you want to support.
         3. Apply your selected languages to the template.
         Notifications display in the language of each user's device if you applied that language to the template. Otherwise, notifications display in English.
      4. Specify notification text for one or more security event types.
         You can specify coaching notifications for the following types of security events:
         • An attempt to upload or download a file containing sensitive data.
         • An attempt to upload or download sensitive data in non-file based traffic.
         For each event type, complete the following steps:
         1. Select Enable Agent Notification.
         2. Specify a Notification Title that users receive when Enterprise DLP blocks the transfer of sensitive data. For example, Sensitive Data Transfer Detected.
         3. Define the Notification Message that users receive when Enterprise DLP blocks the transfer of sensitive data.
            You can use the following variables in your message templates. Include the brackets for each variable.
            • (File incidents only) [file name]—The name of the file containing sensitive data blocked by Enterprise DLP.
            • [app name]—The application that the user attempted to upload to, download from, or post non-file based content.
            • (File incidents only) [direction]—Specifies whether Enterprise DLP blocked a file upload or download.
            • [action]—The action that Enterprise DLP took when sensitive data was detected. This value is always Blocked.
         4. Select one of the following notification display types:
            • Toast—The notification disappears automatically without requiring user interaction. When you select this option, you can also select the screen location where the toast notification appears.
            • Modal—Users must dismiss the notification manually.

         5. (File incidents only) To let users bypass security policies for legitimate business needs, select Enable Exemption Request.
            If you enable this setting in the template, users can request an exemption for their file upload or download. If the display type is Modal, users can also specify the reason they are requesting an exemption.
            1. Specify whether Enterprise DLP grants exemption requests automatically or sends them to an incident responder for approval.
            2. Specify the number of days that Enterprise DLP allows the exemption before the user must re-request it. The maximum period is 365 days.

   5. Show Preview to see how the coaching notification appears to the user. If you applied additional languages to the template, select each language in the preview to verify the translation and make changes as needed.

   6. Save the Network DLP notification template.
8. Modify a DLP rule to enable end user notification for the rule and to select the notification template for the rule.

   When a user action triggers an incident based on the DLP rule, the user receives a notification based on the notification template.
9. The user who generated the Enterprise DLP incident can view the Data Security notification for more information about the sensitive data uploaded, downloaded, or posted.

   A Data Security notification is displayed for seven days. There is no limit to the number of notifications displayed.