DLP and CASB integration info - which DLP response rules and attributes should work in DLP integrations with the CloudSOC?

Products

• Data Loss Prevention Cloud Detection Service
• CASB Audit
• CASB Gateway Advanced
• Data Loss Prevention Cloud Package

Issue/Introduction

Customers with CloudSOC (aka Elastica CASB) integrated with DLP Cloud Detection Service have lots of options in the CloudSOC that don't appear to function after DLP is integrated.

This KB provides links to TechDocs and other KBs, to assist with troubleshooting and knowledge-sharing.

Environment

DLP Cloud Detection Service with REST Detector

CloudSOC

Cause

Not all Securlets and Gatelets in DLP are ready to use with the CloudSOC apps - even when those apps exist in the customer's Elastica CASB Console.

And not all Response Rules will work as expected with ALL CloudSOC apps.

Resolution

Firstly, for Response Rules, we have some details in the following KB articles:

• Which Response Rules can be used with Data-at-Rest versus Data-in-Motion? (broadcom.com)
• Configuring response rule actions (broadcom.com) (25.1 version)
• Symantec Data Loss Prevention response rule actions for Symantec CloudSOC Securlets (broadcom.com) (nice matrix)