File shadowing
File shadowing allows you to capture evidence when users violate data loss prevention policies.
When file shadowing is enabled, the FortiDLP Agent copies the files associated with policy violations and sends them to an external storage location. From there or from the FortiDLP Console, operators can download the shadow copies and reference them during threat investigations.
With file shadowing, you own and manage your data. Shadow copies are not uploaded to the FortiDLP Infrastructure; they are only uploaded to your chosen storage location which is accessed directly by the FortiDLP Agent. Your data is protected at motion and at rest. Before transferring shadow copies, the FortiDLP Agent encrypts them and establishes a secure connection to the storage service via Transport Layer Security (TLS). Only private key holders can view shadow copies, who must first decrypt them using the FortiDLP Decryption Tool. Fortinet provides two versions of this tool—a GUI version, which is available as a browser extension for Google Chrome, Microsoft Edge, and Firefox (recommended), and a command-line interface (CLI) version. Both tools are compatible with all OSs.
File shadowing actions can be executed on all OSs, and shadow copies can be stored on-premises with MinIO, or on the cloud with Amazon Web Services (AWS), Google Cloud Storage (GCS), or Microsoft Azure Blob Storage.
File shadowing setup
The following table provides an overview of the tasks required to enable file shadowing.
| Task | Description |
|---|---|
| Downloading the FortiDLP Decryption Tool | To get started, you will need to download the FortiDLP Decryption Tool Extension or FortiDLP Decryption CLI Tool. |
|
Depending on your storage vendor: |
Next, you need to perform vendor-side setup. This entails creating a secure storage bucket/container and granting the FortiDLP Agent and operators access to it. For MinIO, you must also configure a TLS certificate to enable secure connections between the Agent and the storage server. |
| Next, you must configure FortiDLP with your storage vendor and bucket details, along with local storage and file size limits. | |
| Next, we recommend testing your configuration to ensure it is working as expected. During this stage, you verify that a test shadow copy can be uploaded to your storage bucket and that it can also be downloaded. | |
| Then, using the FortiDLP Decryption Tool Extension or FortiDLP Decryption CLI Tool, you will need to generate an encryption key and then add the public key component to the FortiDLP Console. This key enables the FortiDLP Agent to encrypt shadow copies and for operators to later decrypt them. | |
| Lastly, you must configure and enable policy templates to execute the make shadow copy action. |