Edit the Enterprise DLP Data Filtering Settings on Strata Cloud Manager

1. Log in to Strata Cloud Manager.
2. Select ConfigurationData Loss PreventionSettingsData Transfer and edit the Data Transfer settings.
3. Configure the File Based Settings.

   You can configure any of these settings as needed. You must Save any changes to your file based settings for them to take effect and be enforced.

   • File Movement Max Latency (sec)—Maximum allowed time it takes for the enforcement point to forward a file to Enterprise DLP for inspection.
     For inspection of files greater than 20 MB, Palo Alto Networks recommends setting the max latency to greater than 60 seconds.
   • Action When Max Latency is Reached—Action the enforcement point takes if Enterprise DLP can't inspect and render a verdict on traffic matches because the time it takes to forward a file to Enterprise DLP exceeds the File Movement Max Latency (sec) setting.
     Supported actions are Allow (default) or Block.
   • Scan Limit Max File Size for Alert (MB)—Enforce a maximum file size for files forwarded to Enterprise DLP when traffic matches a DLP rule configured to Alert.
   • Action When File Size Exceeds Scan Limit—Action the enforcement point takes if the file size forwarded to Enterprise DLP exceeds the Scan Limit Max File Size for Alert (MB).
     Supported actions are Allow (default) or Block.
   • Log Files Not Scanned—Check (enable) to generate a DLP incident when Enterprise DLP can't inspect a forwarded file for any reason.
   • Action When Scanning Error Occurred—Action the enforcement point takes when Enterprise DLP encounters any errors inspecting a forwarded file that prevents rendering a verdict.
     Supported actions are Allow (default) or Block.
4. Edit the Non-File Based Settings.

   You can configure any of these settings as needed. You must Save any changes to your non-file based settings for them to take effect and be enforced.

   • Enable non-file based DLP—Enable this setting to prevent exfiltration of sensitive data in non-file format traffic for collaboration apps, web forms, cloud and SaaS apps, and social media on your network.
     You must enable this setting for Enterprise DLP to scan non-file based traffic and enforce all non-file based settings.
   • Max Latency (sec)—Maximum allowed time it takes for the enforcement point to forward non-file traffic to Enterprise DLP for inspection.
   • Action on Max Latency—Action the enforcement point takes if Enterprise DLP can't inspect and render a verdict on traffic matches because the time it takes to forward non-file traffic to Enterprise DLP exceeds the Max Latency (sec) setting.
     Supported actions are Allow (default) or Block.
   • Min Data Size (B)—Enforce a minimum data size for non-file traffic forwarded to Enterprise DLP.
     Enterprise DLP supports a minimum non-file traffic data size of 250 - 4000 bytes.
   • Max Data Size (KB)—Enforce a maximum data size for non-file traffic forwarded to Enterprise DLP.
     Enterprise DLP supports a maximum non-file traffic data size of 1-500 KB.
   • Action on Max Data Size—Action the enforcement point takes if Enterprise DLP can't inspect and render a verdict on traffic matches because the inspected non-file traffic exceeds the Max Data Size (KB) setting.
     Supported actions are Allow (default) or Block.
   • Log Files Not Scanned—Check (enable) to generate a DLP incident when Enterprise DLP can't inspect forwarded non-file traffic for any reason.
   • Enable WebSocket Inspection—Enable this setting to prevent exfiltration of sensitive data through WebSocket persistent streams. Review the supported apps to verify whether an app requires WebSocket inspection to be enabled.
5. In the DLP Settings, configure the Action on any Error to specify the action the enforcement point takes when any kind of error occurs that prevents Enterprise DLP from inspecting forwarded file or non-file traffic and rendering a verdict.

   This includes errors triggered when the enforcement point encounters traffic that falls outside configured thresholds, such as non-file traffic smaller than Min Data Size (B), files exceeding Action on Max File Size (file), or non-file traffic exceeding Max Data Size (KB) (non-file).

   • Allow (default)—Allows the file or non-file traffic to continue to the intended destination when Enterprise DLP encounters an error.
   • Block—Blocks the file or non-file traffic when Enterprise DLP encounters an error.

   Save.
6. Push your data filtering settings.

   For the Admin Scope, select All Admins to ensure Enterprise DLP configuration changes propagate to all enforcement points.

   Enterprise DLP configuration changes don't display in Strata Cloud Manager config snapshots.

   1. Select ConfigurationNGFW and Prisma Access.
   2. Select Push Config and Push.
   3. Select enforcement points you want to push to.
   4. Push.