DLP - Get User Feedback via Email

Get the user feedback via email on a blocked file, whether it is false or true positive and if an exemption is needed.

Enterprise DLP by Palo Alto Networks · 10 tasks · 7 inputs · 1 output

Inputs

  • UserDisplayName — The display name of the user.
  • data_profile_name — The name of the DLP data profile that detected the violation.
  • file_name — The name of the file that triggered the incident.
  • question_type — Whether to ask the user about the file content or about an exemption.
  • SendMailInstance — The name of the instance to be used when executing the "send-mail" command in the playbook. In case it will be empty, all available instances will be used (default).
  • UserEmail — The user email address.
  • Snippets — The snippets of the violation.

Outputs

  • UserRequestedExemption — Whether the user requested exemption or not.

Commands used

pan-dlp-update-incident setIncident

Flowchart

About-File Exemption No Yes No Yes Start Start Check question type Check question type Done Done Set feedback to "true positive" - setIncident Set feedback to "true pos... setIncident Set feedback to "False Positive" - setIncident Set feedback to "False Po... setIncident Set feedback status to "Pending" - pan-dlp-update-incident Set feedback status to "P... pan-dlp-update-incident Save user answer - SetAndHandleEmpty Save user answer SetAndHandleEmpty Save user answer - SetAndHandleEmpty Save user answer SetAndHandleEmpty Ask file-info via email Ask file-info via email Ask exemption via email Ask exemption via email