Overview of Forcepoint databases

Administering Forcepoint Databases | Web, Data, and Email Solutions | April 2022

Applies to:

Forcepoint Web Security and Forcepoint URL Filtering, v8.5.x

Forcepoint DLP, v8.5.1, v8.6.x, v8.7.x, v8.8.x, v8.9.x

Forcepoint Email Security, v8.5.x

Forcepoint appliances, v8.5.x

The on-premises Forcepoint security solutions use a variety of databases for different purposes: configuration information, reporting data, URL categorization, fingerprinting, and forensics. Several data formats are used, including SQL, PostgreSQL, and Forcepoint proprietary formats.

These databases include:


Database	Description
Reporting Databases	Web, data, and email security products SQL Server databases that store reporting and logging data for individual Forcepoint security products. The Data reporting database also stores configuration data. See Understanding the reporting databases.
Settings Database	Web, data, and email security products PostgreSQL database that stores global configuration and infrastructure settings that affect all Forcepoint Security Manager modules. It is installed automatically on the Forcepoint management server and requires no administrator configuration.
Forcepoint URL Database	Web products only Proprietary database that contains URL categories and protocol definitions, as well as supporting information, such as risk class groupings. A copy of the URL Database resides on each Filtering Service machine. By default, a full update is performed daily. Incremental updates can occur much more frequently if they are enabled on the Web > Settings > General > Database Download page in the Forcepoint Security Manager. See Administrator Help for your web protection solution for further details.
RTM Database	Web products only Holds and organizes filtering data for display in Real-Time Monitor. This is an independent database (not hosted on SQL Server) installed with each RTM Client and RTM Server instance. Administrators can specify when Real-Time Monitor captures data on the Web > Settings > Reporting > Preferences page in the Forcepoint Security Manager. No other aspect of database behavior is configurable.
Web Forensics Database	Forcepoint Web Security only Stores details about files that may be associated with advanced malware threat activity in your network. Enable or disable the forensics repository and configure its location and size on the Web > Settings > Reporting > Dashboard page in the Forcepoint Security Manager. See "Configuring Dashboard reporting data" in the Administrator Help for your web protection solution for details.
Data Fingerprint Database	Forcepoint DLP only Stores data security fingerprints. See Data Fingerprint Database.
Data Forensics Database	Forcepoint DLP only Contains information about DLP and discovery transactions that resulted in incidents, such as the contents of an email body, including the From:, To:, and Cc: fields, as well as actual attachments. Transactions can also include web posts, endpoint operations, and discovered as well as other events. For transactions that occurred on a web channel, the forensics might include the URL category property. Configure the size and location of the forensics repository in the Data Security module of the Forcepoint Security Manager. Navigate to the Settings > Deployment > System Modules page and click Forensics Repository under the management server.

Data Fingerprint Database

One of the ways that you can classify data in Forcepoint DLP is by "fingerprinting" it. This allows the detection of sensitive information despite manipulation, reformatting, or other modification. Fingerprints enable the protection of whole or partial documents, antecedents, and derivative versions of the protected information, as well as snippets of the protected information whether cut and pasted or retyped.

When you fingerprint data, the fingerprints are stored in the Data Fingerprint Database on the Forcepoint management server and pushed to other Forcepoint DLP components for fast analysis on those machines.

To tune performance, you can configure the disk space and cache size of the database on the management server in the Data Security module of the Forcepoint Security Manager. To do so:

Log onto the Security Manager.

Navigate to the Data > Settings > Deployment > System Modules page.

Select Primary Fingerprint Repository under the management server.

Adjust the maximum disk space and cache size as needed.

Secondary repositories are maintained by Content Gateway and Forcepoint Email Security. You can configure Forcepoint DLP to detect fingerprints from repositories local to those machines (best practice) or from a remote machine, such as the management server.

Periodically, you must synchronize the fingerprints in the secondary repositories with the ones on the management server. How often you synchronize depends on your business needs. For best performance, select a time with low traffic volume.

To configure these settings:

Navigate to the Settings > Deployment > System Modules page.

Select Secondary Fingerprint Repository under the component or solution of interest.

Choose the repository from which to detect fingerprints.

Set the maximum cache size and synchronization frequency as needed.

See "Configuring the fingerprint repository" in the Forcepoint DLP Administrator Help for instructions on configuring these settings.