DLP - Get User Feedback

Get the user feedback on a blocked file, whether it is false or true positive and if an exemption is needed.

Enterprise DLP by Palo Alto Networks · 24 tasks · 5 inputs · 1 output

Details

IDDLP - Get User Feedback
From Version6.8.0
Tasks24

README

Get the user feedback on a blocked file, whether it is false or true positive and if an exemption is needed.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

DLP - Get User Feedback via Email

Integrations

Palo_Alto_Networks_Enterprise_DLP

Scripts

  • Set
  • SetAndHandleEmpty
  • DlpAskFeedback

Commands

  • pan-dlp-get-report
  • setIncident
  • pan-dlp-exemption-eligible
  • pan-dlp-update-incident

Playbook Inputs

Name Description Default Value Required
UserDisplayName The display name of the user.   Optional
MessageApp Choose the application to communicate with the users.
Available options:
- Slack
- Microsoft Teams		   Optional
SendMailInstance The name of the instance to be used when executing the “send-mail” command in the playbook. In case it will be empty, all available instances will be used (default).   Optional
UserEmail The user email address.   Optional
Detections Detected violation snippets.   Optional

Playbook Outputs

Path Description Type
UserRequestedExemption Whether the user requested exemption or not. unknown

Playbook Image

DLP - Get User Feedback

Inputs

  • UserDisplayName — The display name of the user.
  • MessageApp — Choose the application to communicate with the users. Available options: - Slack - Microsoft Teams
  • SendMailInstance — The name of the instance to be used when executing the "send-mail" command in the playbook. In case it will be empty, all available instances will be used (default).
  • UserEmail — The user email address.
  • Detections — Detected violation snippets.

Outputs

  • UserRequestedExemption — Whether the user requested exemption or not.

Commands used

pan-dlp-exemption-eligible pan-dlp-update-incident setIncident

Flowchart

Yes yes no No Yes yes yes Start Start Set feedback to "true positive" - setIncident Set feedback to "true pos... setIncident Set feedback to "False Positive" - setIncident Set feedback to "False Po... setIncident User answered "Yes"? User answered "Yes"? Set feedback status to "Pending" - pan-dlp-update-incident Set feedback status to "P... pan-dlp-update-incident Save feedback to DLP - pan-dlp-update-incident Save feedback to DLP pan-dlp-update-incident Ask user if file contains sensitive info - DlpAskFeedback Ask user if file contains... DlpAskFeedback Get eligibility for exemption - pan-dlp-exemption-eligible Get eligibility for exemp... pan-dlp-exemption-eligible Is eligible? Is eligible? Is there a previous notification for the file? Is there a previous notif... Did user ask for exemption? Did user ask for exemption? Set feedback status to "Pending" - pan-dlp-update-incident Set feedback status to "P... pan-dlp-update-incident Ask user if exemption needed - DlpAskFeedback Ask user if exemption needed DlpAskFeedback Set include_violation_detail to False - Set Set include_violation_det... Set Set include_violation_detail to True - Set Set include_violation_det... Set Done Done User requested exemption? User requested exemption? Save user answer - SetAndHandleEmpty Save user answer SetAndHandleEmpty Save user answer - SetAndHandleEmpty Save user answer SetAndHandleEmpty DLP - Get User Feedback via Email - DLP - Get User Feedback via Email DLP - Get User Feedback v... DLP - Get User Feedback via E... Get user feedback by email? Get user feedback by email? Get user feedback by email? Get user feedback by email? DLP - Get User Feedback via Email - DLP - Get User Feedback via Email DLP - Get User Feedback v... DLP - Get User Feedback via E... Set feedback status to "Exception Requested" - pan-dlp-update-incident Set feedback status to "E... pan-dlp-update-incident

Source

playbook-DLP_-_Get_User_Feedback.yml playbook-DLP_-_Get_User_Feedback_via_Email.yml playbook-DLP_-_Get_User_Feedback_via_Email_README.md
Download History Raw 
Get the user feedback via email on a blocked file, whether it is false or true positive and if an exemption is needed.

## Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

### Sub-playbooks

This playbook does not use any sub-playbooks.

### Integrations

Palo_Alto_Networks_Enterprise_DLP

### Scripts

SetAndHandleEmpty

### Commands

* setIncident
* pan-dlp-update-incident

## Playbook Inputs

---

| **Name** | **Description** | **Default Value** | **Required** |
| --- | --- | --- | --- |
| UserDisplayName | The display name of the user. |  | Optional |
| data_profile_name | The name of the DLP data profile that detected the violation. |  | Optional |
| file_name | The name of the file that triggered the incident. |  | Optional |
| question_type | Whether to ask the user about the file content or about an exemption. |  | Optional |
| SendMailInstance | The name of the instance to be used when executing the "send-mail" command in the playbook. In case it will be empty, all available instances will be used \(default\). |  | Optional |
| UserEmail | The user email address. |  | Optional |
| Snippets | The snippets of the violation. |  | Optional |

## Playbook Outputs

---

| **Path** | **Description** | **Type** |
| --- | --- | --- |
| UserRequestedExemption | Whether the user requested exemption or not. | unknown |

## Playbook Image

---

![DLP - Get User Feedback via Email](../doc_files/DLP_-_Get_User_Feedback_via_Email.png)