Enterprise DLP by Palo Alto Networks (v2.3.0)
Palo Alto Networks Enterprise DLP Integration
- Author
- Palo Alto Networks Enterprise DLP
- Support
- xsoar
- URL
- https://www.paloaltonetworks.com/enterprise-data-loss-prevention
- Categories
- Network Security
Incident fields (10)
- DLP Detections
- PAN DLP Action
- PAN DLP Channel
- PAN DLP Data Profile Name
- PAN DLP Incident Feedback
- PAN DLP Incident ID
- PAN DLP Incident Region
- PAN DLP Previous Feedback
- PAN DLP Report ID
- PAN DLP Tenant ID
Integrations (1)
- Palo Alto Networks Enterprise DLP
Layouts (1)
- Palo Alto Networks Enterprise DLP Incident Layout
Playbooks (4)
- DLP - Get Approval
- DLP - Get User Feedback
- DLP - Get User Feedback via Email
- DLP - User Message App Check
Scripts (1)
- DlpAskFeedback
README
Palo Alto Networks Enterprise DLP Content Pack
This content pack enables Cortex XSOAR to integrate with Palo Alto Networks Enterprise DLP. Using this content pack, you can fetch DLP incidents and update DLP incidents with user feedback. This pack includes the Palo Alto Networks Enterprise DLP integration and a sample playbook to gather user feedback for a DLP incident using Slack.
Palo Alto Networks Enterprise DLP Integration
Integrates with the Enterprise DLP service to get details about DLP violations and to update DLP incidents with user feedback.
The integration includes commands to:
- Fetch DLP incidents from the “NGFW” and “Prisma Access” channels.
- Fetch DLP reports with data pattern match details.
- Fetch DLP reports with data pattern match details and snippets from the file.
- Update a DLP incident with user feedback and approval process.
- Check if the option to exempt the violation should be provided for a given DLP data profile name.
- Get approval for any exemption requests.
- Send a customized Slack bot message to the user to ask for feedback.
- Reset the last run.