Manage Secure ICAP

You can forward the payload of Realtime DLP violations to on-premises DLP solutions using the secure Internet Content Adaptation Protocol (ICAP). Through ICAP, Umbrella DLP sends the payload that triggers a Realtime rule violation to an on-premises DLP.

To add Secure ICAP integration, define the ICAP server information in Umbrella as described in this topic.

Once you have established an ICAP connection, by default the payload of all active Realtime DLP rule violations will be sent over ICAP. You can disable this on a rule-by-rule basis; see Add a Real Time Rule to the Data Loss Prevention Policy for more information.

Prerequisites

• Full admin access to the Umbrella dashboard. See Manage User Roles.
• You must have the ICAP server endpoint URI.
• You must have the SSL certificate for the ICAP server.
• We recommend you allow only the following IP addresses to your firewall (to prevent abuse of the API connection):
  • 50.18.191.74
  • 54.153.85.86
  • 54.90.48.200
  • 3.234.7.118

Secure ICAP Integration

1. Navigate to Admin > Authentication.
2. Expand the ICAP section and click Add Secure ICAP Endpoint.

3. Enter the ICAP Server Endpoint URI. (For example, icaps://k8s-dlprealt-cicapser-3ea8931f8c-c051176b1c4f93fc.elb.us-west-1.amazonaws.com:11344/echo)

4. Provide the ICAP server Certificate that will be used when the ICAP server requests client authentication. Use one of the following methods:

• Drag and drop the certificate from your local system to the designated place on the screen.

  -or-

• Click Or select file, navigate to the certificate on your local system, and select the file to upload.

5. Click Save
6. The display will reflect when the connection is successfully established.

Modify an ICAP Server Connection

1. Navigate to Admin > Authentication.
2. Click EDIT next to the displayed ICAP server connection information.

3. Enter new values for the ICAP Server Endpoint URI, the server Certificate, or both. (See Steps 3 and 4 of Secure ICAP Integration ).
4. Click SAVE
5. The system will attempt to reestablish the connection to the ICAP server with the new parameters and report success or failure.

Disconnect from an ICAP Server

1. Navigate to Admin > Authentication.
2. Choose the ICAP server connection to disconnect and click REVOKE.

3. Click DELETE to confirm your choice.

4. The system will delete the URI and certificate for the connection; the connection will no longer be available for real time rules that have information sharing through ICAP enabled.

Enable SSO with Other IDPs < Manage Secure ICAP > Manage Cloud Malware Protection