Documentation | Support

Go to the table of contents Go to the previous page Go to the next page View or print as PDF
Configuring the Mobile DLP Policy > Configuring mobile DLP attributes > Mobile DLP attribute properties
Mobile DLP attribute properties
Administrator Help | Forcepoint DLP | Version 8.4.x
The table below lists the mobile DLP attributes and their configurable properties:
 
Field
Description
Message size
The size of email messages to monitor. Only messages of the specified size or higher are monitored. The default size is 10 MB.
Default severity: low.
Available actions: quarantine (default), permit.
Regulatory & Compliance
The regulatory and compliance laws to enforce. These are applied for all configured regions. (If you have not selected regions, an error is displayed. Click Select regions to address the issue.)
*
Personally Identifiable Information (PII)
*
Protected Health Information (PHI)
*
Payment Card Industry (PCI DSS)
After selecting a law, click its name to view or edit the specific policies to enforce, then select a sensitivity for each policy.
*
Wide is highly sensitive and errs on the restrictive side. To avoid leaking sensitive data, it is more likely to produce a false positive (unintended match) than a false negative (content that is not detected).
*
Default balances the number of false positives and false negatives.
*
Narrow is the least restrictive. It is more likely to let content through than to produce an unintended match.
Default severity: high.
Available actions: quarantine (default), permit.
Attachment name
One by one, enter the names of the exact files that should be monitored when they're attached to an email message. Include the filename and extension. Click Add after each entry.
For example, after adding a file named confidential.docx, when a user attaches a file with that name to an email message, the system detects it and takes the configured action.
Default severity: low.
Available actions: quarantine (default), permit
Attachment type
Click Add to specify the types of files that should be monitored when attached to an email message, for example Microsoft Excel files.
Select the type or types of files to monitor. If there are more file types than can appear on the page, enter search criteria to find the file type you want. The system searches in the file type group, description, and file type for the data you enter.
If the file type does not exist, specify exact files of this type using the Attachment name attribute instead.
Default severity: low.
Available actions: quarantine (default), permit.
Patterns & phrases
Click Add to define key phrases or regular expression (regex) patterns that should be monitored. Regex patterns are used to identify alphanumeric strings of a certain format.
On the resulting dialog box, enter the precise phrase (for example "Internal Only") or regex pattern (for example ~ m/H.?e/) to include.
Select how many phrase matches must be made for the policy to trigger. The default number of matches is 1.
Define whether to search for the phrase or regex pattern in all email fields, or in one or more specific fields. For example, you may want to search only in an attachment, or skip searching in To and CC fields.
Default severity: medium.
Available actions: quarantine (default), permit.
Note:
Although you do not define whether to search only for unique strings, the system uses the following defaults:
*
Key phrase searches are non-unique. All matches are reported.
*
For regular expression searches, only unique matches are reported as triggered values.
Acceptable use
Select the dictionaries that define unacceptable use in your organization.
Forcepoint DLP includes dictionaries in several languages. Select the languages to enforce. Only terms in these languages are considered a match. For example, if you select the Adult dictionary in Hebrew, then adult terms in English are not considered an incident.
Note that false positives (unintended matches) are more likely to occur when you select multiple languages. For this reason, exercise caution when selecting the languages to enforce.
You cannot add or delete terms from predefined dictionaries, but you can exclude terms from detection, if needed. Do this on the Main > Content Classifiers > Patterns & Phrases page. Select the dictionary to edit, then enter the phrases to exclude.
By default, the policy is triggered by a single match from the dictionary or dictionaries you select.
Default severity: medium.
Available actions: quarantine (default), permit.
Questionable images
Select this attribute to prevent pornographic images from entering your organization. Pornographic images pose a legal liability to organizations in many countries.
The system judges images based on the amount of flesh tone they contain.
Default severity: low.
Available actions: quarantine (default), permit.
Defining mobile DLP trusted users
Administrator Help | Forcepoint DLP | Version 8.4.x
Trusted users are those that the organization does not want monitored. Forcepoint DLP does not analyze email sent to mobile devices for trusted users.
If you have users that should not receive mobile DLP policy enforcement:
1.
Select Enable trusted users.
2.
Click Edit.
3.
Browse to identify the trusted users, directory entries, and business units.

Go to the table of contents Go to the previous page Go to the next page View or print as PDF
Configuring the Mobile DLP Policy > Configuring mobile DLP attributes > Mobile DLP attribute properties
Copyright 2017 Forcepoint. All rights reserved.