DLP Harmonization

Beta

This feature is currently in beta.

DLP harmonization is the process by which Cortex connects to your DLP providers, extracts their policy configurations, and restructures the provider-specific data into a single normalized schema. These normalized policies are stored in the Cortex Data Inventory as assets. Because every provider's fields are mapped to the same schema, you can compare, filter, and sort policies from all of them in one inventory through the Unified Policies page.

Cortex currently ingests and normalizes DLP policies from Cortex Endpoint DLP and Microsoft Purview.

Additional providers are planned for future releases.

The Unified Policies page

The normalized results are presented on the Unified Policies page, at Modules → Data Security → Data Loss Prevention → Unified Policies. This page is the single inventory of every DLP policy Cortex has ingested.

Cortex maps all ingested policies into a policy and rule model. In this structure:

• Policies act as the overarching containers that group related data protection guidelines.
• Rules are the specific, actionable conditions nested inside a policy that determine exactly what triggers an alert or response.

A single policy can contain multiple rules, and each rule maintains its own individual settings, priorities, and statuses. For example, you can have a fully active policy that contains a mix of active and inactive rules.

The following image shows the Unified Policies page:

Widgets across the top summarize policy counts by status, connected providers, the most common data profiles, and coverage by channel. Teams can use these to analyze operational states and identify coverage gaps.

Below them, a table lists every normalized policy, one row per policy, filterable and exportable on any field. The table displays only a default selection of fields as columns; use Display to add or remove them. The fields displayed by default give key details about the policy, outlining what it covers, it's activity mode, who last modified it and when, and when it was created and last scanned.

To drill down further, click any policy to view simplified Overview and Configuration tabs for immediate clarity on policy intent and rule logic.

The Overview tab displays more detailed information about the policy, including a description, its audience and exclusions, and its provider piority.

The Configuration tab lists the policy's rules in priority order. Expanding a rule shows its detection conditions, which you can read either as a visual AND/OR/NOT tree or as code.

Only policies from connected providers appear in the inventory, and each provider has its own requirements. See Connecting your DLP providers for details.

The inventory is read-only. Editing a policy through the Unififed Policies Page is not supported. Cortex re-scans each connected provider every 12 hours, picking up new, updated, and deleted policies without user intervention. A policy deleted upstream disappears from the inventory on the next scan. Each row's Last scanned field records the most recent successful pull, so check it before treating a row as authoritative for a recent change.

Connecting your DLP providers

Each provider has its own connection method. If you disable a connector, its policies remain in the inventory for 30 days but are no longer updated.

Cortex Endpoint DLP

Ingesting Endpoint DLP policies is automatic if you have Endpoint DLP policies configured in Cortex.

Microsoft Purview

Onboard Purview through the Microsoft Security Connector at Settings → Data Sources. The wizard walks you through selecting Purview, enabling the Policies Discovery capability, running a generated script in your Azure environment, and entering the resulting credentials. For the full procedure, see the Microsoft Security connector documentation.