Remove / Decouple CloudSOC Detector from DLP Enforce

Products

• CASB Security Advanced
• Data Loss Prevention

Issue/Introduction

How to remove/decouple CASB Cloud Detector from DLP Enforce. 

 

Environment

Integrated CASB and DLP environment

Resolution

•  Deactivate DLP from CloudSOC Settings. Login as Admin to CloudSOC > Settings > Symantec DLP

•  If there's not a hurry to perform the removal, it's recommended that the integration is first deactivated before 'Removal' and test to confirm there aren't unexpected effects to either the DLP or CloudSOC.

•  Once ready, proceed to Remove System

•  In DLP Console, go to System > Servers and Detectors > Overview

•   Click the red 'x' for the cloud detector on the right corner.

•  The process of subsequent removal/deactivation of specific Policies/ Policy Groups/Scan Filters and other configuration is beyond the scope of this article as this varies depending on if you are continuing with DLP or CASB, etc. For example, a Policy in DLP may have been in use for both CASB and DLP (premise) events so we won't assume the removal of the Policy altogether is recommended as this depends on your configuration preference.