Skip to main content

Clearswift DLP

The Clearswift Endpoint Data Loss Prevention (DLP) solution offers visibility, control, monitoring and policies that help a company protect its assets.

Clearswift DLP

This pack includes Cortex XSIAM content.

Configuration on Server Side

You need to configure Clearswift DLP to forward Syslog messages.

Open your Clearswift instance UI and follow these instructions:

  1. From the Home page, click System > Monitoring & Control > Logs & Alarms.
  2. Click the Log Export tab and select Enable log export.
  3. Enter the IP Address (OR Hostname) and Port number of your Syslog server. The default port is 514.
  4. Enter a Poll Interval (minutes). The recommended setting is once every 5 minutes. You can enter a value between 1 and 60 minutes.
  5. Make a selection of the log types you want to export using the checkboxes adjacent to the list.

Collect Events from Vendor

In order to use the collector, use the Broker VM option.

Broker VM

To create or configure the Broker VM, use the information described here.

You can configure the specific vendor and product for this instance.

  1. Navigate to Settings > Configuration > Data Broker > Broker VMs.
  2. Right-click, and select Syslog Collector > Configure.
  3. When configuring the Syslog Collector, set the following values:
    • vendor as vendor - clearswift
    • product as product - dlp

PUBLISHER

Cortex

PLATFORMS

Cortex XSIAM

INFO

CertificationRead more
Supported ByCortex
CreatedMarch 30, 2023
Last ReleaseDecember 3, 2023
DISCLAIMER
Content packs are licensed by the Publisher identified above and subject to the Publisher’s own licensing terms. Palo Alto Networks is not liable for and does not warrant or support any content pack produced by a third-party Publisher, whether or not such packs are designated as “Palo Alto Networks-certified” or otherwise. For more information, see the Marketplace documentation.