Cortex DLP threat detection and issues

The Cortex DLP module prevents sensitive data exfiltration. If instances of data-in-motion rules have been violated, a DLP issue is generated. To view the DLP Issues, go to Data Security → Data Security Issues → Threats. The Detection Method is set to DLP.

DLP issues provide visibility into instances where data-in-motion rules have been violated.

From Data Security → Data Security Issues → Threats, you can view the DLP issues. The Detection Method is set to DLP.

Note

Access to this page is restricted to users with the roles: Data Security Admin, Instance Administrator, and Account Admin.

The parameters configured during rule creation are shown as issue attributes on this page. These include:

• Name: Taken from the Raised Issue Name field defined when creating the rule.
• Severity: The assigned severity level of the Issue.
• Description: The predefined description from the rule.
• Detection method: When an issue arises from a data-in-motion rule violation, its Detection Method is DLP.
• Action: How the rule responded to the issue: Prevented (Blocked), Allow, or Report.

Note

If the default action configured in Endpoint DLP Settings is set to Block file movement (fail-close), an issue is raised where the assigned severity is set to low, and includes the Name Data movement blocked by Endpoint DLP default action

View the DLP issue card panel

Click a DLP issue to open the DLP security card, where you can investigate the issue, take any required actions, and view remediation suggestions.

From the three-dot menu, you can open the issue in a new tab, copy the issue URL, retrieve the file, or view raw data (JSON).

Some other important actions:

• Retrieve File: From the asset card, click to obtain a copy of the file that triggered the security alert. Note: Files remain available for retrieval until they are deleted.
• Click to open the related rule that triggered the issue.

At the top of the card, you can view information about the issue, including the severity, detection tags, category, and detection method. In the tabs, you can see more information about the cause of the issue, take any required actions, and view remediation suggestions.

You can also see the details of the user who logged into the browser.

Overview

Displays a description of the issue and provides key information, such as the assignee, status, action taken, and the time that the issue was created and updated.

You can also see the following:

• Evidence: which includes data classification details such as Data Profiles, Data Patterns, Classification Status, and Profile Indicators.

  Click the Profile Indicators link to view the list of sensitive data contained in the file.

  The graph enables you to view information on the relevant file and logged-in user details.
• File that includes the Name, Hash, Path, and Data Volume of the file.

  The path shows the full path of the uploaded file.
• Local Applications, which include Process Name, Signer, Application Name, and Application Group Name.
• User Interaction that includes User Response.

War Room

A comprehensive collection of all investigation actions, artifacts, and collaboration. It is a chronological journal of the issue investigation. For information, see Use the War Room in an investigation.

Work Plan

A visual representation of the running playbook that is assigned to the issue. For more information, see Use the Work Plan in an investigation.