Palo Alto Networks Enterprise DLP

category: Network Security
provider: Palo Alto Networks
sectionorder:
- Connect
- Collect
commonfields:
  id: Palo Alto Networks Enterprise DLP
  version: -1
configuration:
- display: Server URL
  name: base_url
  type: 0
  required: false
  defaultvalue: https://api.dlp.paloaltonetworks.com/v1/
  section: Connect
- display: Authentication URL
  name: auth_url
  type: 0
  required: false
  defaultvalue: https://auth.apps.paloaltonetworks.com/auth/v1/oauth2/access_token
  section: Connect
- additionalinfo: Access token generated in the Enterprise DLP UI
  display: Access Token
  name: credentials
  required: true
  type: 9
  displaypassword: Refresh Token
  section: Connect
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
  advanced: true
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
  advanced: true
- display: Fetch incidents
  name: isFetch
  type: 8
  required: false
  defaultvalue: 'true'
  section: Collect
  supportedModules:
  - agentix
  - xsiam
- display: Incident type
  name: incidentType
  type: 13
  defaultvalue: "Data Loss Prevention"
  required: false
  section: Collect
  supportedModules:
  - agentix
  - xsiam
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: "1"
  type: 19
  required: false
  section: Collect
  supportedModules:
  - agentix
  - xsiam
- display: First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
  name: first_fetch
  type: 0
  defaultvalue: 60 minutes
  required: false
  section: Collect
- name: max_fetch
  display: Maximum number of incidents per fetch
  defaultvalue: '50'
  required: false
  type: 0
  section: Collect
  supportedModules:
  - agentix
  - xsiam
- display: Fetch Lookback Window (minutes)
  name: look_back
  defaultvalue: '0'
  type: 0
  required: false
  additionalinfo: The number of minutes to look back during each fetch to capture late-indexed incidents.
  section: Collect
  advanced: true
- display: DLP Regions
  name: dlp_regions
  type: 16
  options:
  - US  # United States
  - EU  # European Union
  - AP  # Asia-Pacific
  - UK  # United Kingdom
  - CA  # Canada
  - AU  # Australia
  - IN  # India
  - JP  # Japan
  - BR  # Brazil
  - PAR # Paris
  - SUI # Switzerland
  required: false
  section: Collect
- display: Data profiles to allow exemption
  name: dlp_exemptible_list
  type: 0
  additionalinfo: A comma-separated list of data profile names to request an exemption. Use "*" to allow everything.
  required: false
  section: Collect
- display: Bot Message
  name: dlp_slack_message
  type: 12
  additionalinfo: The message to send to the user to ask for feedback.
  defaultvalue: Hi $user🔔, \n\n*We need your feedback:* \n\nYour activity on *$app_name* was blocked due to company policy. The data in this activity contains sensitive information which violates *$data_profile_name* policy.\n\nfilename - *$file_name* \n\n $snippets\n\n
  required: false
  section: Collect
description: Palo Alto Networks Enterprise DLP discovers and protects company data across every data channel and repository. Integrated Enterprise DLP enables data protection and compliance everywhere without complexity.
display: Palo Alto Networks Enterprise DLP
name: Palo Alto Networks Enterprise DLP
script:
  commands:
  - name: pan-dlp-get-report
    arguments:
    - name: report_id
      required: true
      description: DLP report ID.
    - name: fetch_snippets
      auto: PREDEFINED
      predefined:
      - 'true'
      - 'false'
      description: If True, includes snippets with the reports.
      defaultValue: 'false'
    - name: service_name
      auto: PREDEFINED
      predefined:
        - ngfw
        - prisma-access
        - prisma-saas
        - prisma-access-browser
        - endpoint-dlp
      description: The DLP service that the report belongs to. Determines which backend the report is retrieved from. When empty, the request does not specify a service and the server retrieves the report from Prisma Access.
    outputs:
    - contextPath: DLP.Report.DataProfile
      description: The data profile name.
    - contextPath: DLP.Report.DataPatternMatches.DataPatternName
      description: The DLP data pattern name.
    - contextPath: DLP.Report.DataPatternMatches.Detections
      description: The DLP detection snippets.
    - contextPath: DLP.Report.DataPatternMatches.HighConfidenceFrequency
      description: The number of high confidence occurrences.
    - contextPath: DLP.Report.DataPatternMatches.MediumConfidenceFrequency
      description: The number of medium confidence occurrences.
    - contextPath: DLP.Report.DataPatternMatches.LowConfidenceFrequency
      description: The number of low confidence occurrences.
    - contextPath: DLP.Report.DataPatternMatches.MatchedConfidenceLevel
      description: The matched confidence level of the data pattern (e.g., "high", "medium", "low"). Only present for patterns that matched.
      type: String
    - contextPath: DLP.Report.DataProfiles.Name
      description: The name of the data profile.
      type: String
    - contextPath: DLP.Report.DataProfiles.Id
      description: The ID of the data profile.
      type: Number
    - contextPath: DLP.Report.DataProfiles.Version
      description: The version of the data profile.
      type: Number
    - contextPath: DLP.Report.DataProfiles.IsTriggered
      description: Whether the data profile was triggered.
      type: Boolean
    - contextPath: DLP.Report.DataProfiles.DataPatterns.Id
      description: The data pattern ID within the profile.
      type: String
    - contextPath: DLP.Report.DataProfiles.DataPatterns.IsMatched
      description: Whether the data pattern matched.
      type: Boolean
    - contextPath: DLP.Report.DataProfiles.DataPatterns.ConfidenceLevel
      description: The confidence level configured for the pattern.
      type: String
    - contextPath: DLP.Report.DataProfiles.DataPatterns.OccurrenceCount
      description: The number of occurrences detected.
      type: Number
    - contextPath: DLP.Report.DataProfiles.DataPatterns.OccurrenceOperatorType
      description: The occurrence operator type (e.g., "more_than_equal_to", "between").
      type: String
    - contextPath: DLP.Report.DataProfiles.DataPatterns.OccurrenceLow
      description: The low bound for "between" operator type.
      type: Number
    - contextPath: DLP.Report.DataProfiles.DataPatterns.OccurrenceHigh
      description: The high bound for "between" operator type.
      type: Number
    description: Fetches DLP reports associated with a report ID.
  - name: pan-dlp-update-incident
    arguments:
    - name: incident_id
      required: true
      description: The ID of the incident to update.
    - name: feedback
      required: true
      auto: PREDEFINED
      predefined:
      - PENDING_RESPONSE
      - CONFIRMED_SENSITIVE
      - CONFIRMED_FALSE_POSITIVE
      - EXCEPTION_REQUESTED
      - EXCEPTION_GRANTED
      - EXCEPTION_NOT_REQUESTED
      - OPERATIONAL_ERROR
      - SEND_NOTIFICATION_FAILURE
      - EXCEPTION_DENIED
      description: The user feedback.
    - name: user_id
      required: true
      description: The ID of the user the feedback is collected from.
    - name: region
      description: The region where the incident originated.
    - name: report_id
      description: The DLP report ID, needed only for granting exemptions.
    - name: dlp_channel
      description: The DLP channel, needed only for granting exemptions.
    - name: error_details
      description: Error details if status is SEND_NOTIFICATION_FAILURE.
    outputs:
    - contextPath: DLP.IncidentUpdate.success
      description: Whether the update was successful.
      type: boolean
    - contextPath: DLP.IncidentUpdate.exemption_duration
      description: The exemption duration, only available for "EXCEPTION_GRANTED".
      type: number
    description: Updates a DLP incident with user feedback.
  - name: pan-dlp-exemption-eligible
    arguments:
    - name: data_profile
      required: true
      description: The name of the data profile.
    outputs:
    - contextPath: DLP.exemption.eligible
      description: Whether the data profile is eligible for exemption.
      type: boolean
    description: Determines whether exemption can be granted on incidents from a certain data profile.
  - name: pan-dlp-slack-message
    arguments:
    - name: user
      required: true
      description: The name of the user that receives this message.
    - name: file_name
      required: true
      description: The name of the file that triggered the incident.
    - name: data_profile_name
      required: true
      description: The data profile name associated with the incident.
    - name: snippets
      description: The snippets of the violation.
    - name: app_name
      required: true
      description: The name of the application that performed the activity.
    outputs:
    - contextPath: DLP.slack_message
      description: The Slack bot message.
      type: string
    description: Gets the Slack bot message to send to the user for gathering feedback.
  - name: pan-dlp-reset-last-run
    deprecated: true
    description: Deprecated. Reset the "last run" timestamp via the integration instance configuration window.
  dockerimage: demisto/python3:3.12.13.10404775
  isFetchSamples: true
  isfetch: true
  script: '-'
  subtype: python3
  type: python
fromversion: 5.0.0
tests:
- Palo_Alto_Networks_Enterprise_DLP - Test