Configuring the fingerprint repository

Administrator Help | Forcepoint DLP | Version 8.7.x

The primary Forcepoint DLP fingerprint repository is stored on the management server. The primary repository creates secondary repositories on protector, Content Gateway, and Forcepoint DLP server instances, and on any other module with a policy engine. These contain structured (database) fingerprints and are updated frequently to remain current. File fingerprints are not stored in the secondary repository, because they are transmitted in real time.


	Important Forcepoint does not save or back up your data in the fingerprinting process. The primary fingerprint repository only saves partial hashes of fingerprinted data, in order to detect them in future transactions. For your own protection, make sure you have a backup system in place.

To configure the selected repository:

Enter the Name of the module.

Enter a Description of the module (up to 4000 characters).

Continue with one of the following:

Primary Fingerprint Repository

Secondary Fingerprint Repository

Primary Fingerprint Repository

Under Tuning Performance:

Select the Maximum disk space allocated for use by the fingerprint repository, in megabytes (50,000 MB, by default).

Select the Maximum cache size for the fingerprint repository to use to cache fingerprints in memory, in megabytes (512 MB, by default).

Click OK to save your changes and return to the System Modules page.

Secondary Fingerprint Repository

Secondary fingerprint repositories contain structured data only (database fingerprints). File fingerprints are transmitted in real time so they don't need to be stored on system modules other than the management server.

In the Repository Selection section, use the options under Detect fingerprints from to indicate where fingerprint detection should be performed:

Select the repository installed on to perform detection on a remote repository, then select the server where the repository resides. This is typically the primary repository on the management server, but it can be any repository. Forcepoint recommends selecting a repository in the same LAN as this one.

When the primary repository is selected, administrators never have to perform synchronization. The primary repository is always up to date with the most recent fingerprints.

Select this local repository to have detection performed locally. When this option is selected, performance tuning options are enabled.

Synchronization occurs only when this repository does not have the most up-to-date fingerprints.

If the local repository is selected, under Tuning Performance, select the Maximum cache size (maximum amount of memory) allocated for the fingerprint repository, in megabytes.

Indicate whether there are periods when the secondary repository should not be updated.

By default, secondary repositories check for updates from the primary Continuously (every 30 seconds). This ensures the secondary repository machine always has the latest fingerprints.

To exclude a certain time period from this I/O activity, select Continuously except between and specify the blackout time period—for example: peak business hours.

During this period, the secondary repository will not check with the primary for updates. (Times are assumed to be in the database repository zone.)

Limiting I/O can improve fingerprinting performance, but accuracy can be affected, because the latest fingerprints may not be used.

Click OK to save your changes and return to the System Modules page.