Domino Fingerprinting

Administrator Help | TRITON AP-DATA | Version 8.3.x

With TRITON AP-DATA, you can fingerprint documents stored in an IBM Domino data management system.

Domino environments normally consist of one or more servers working together with data stored in Notes Storage Format (NSF) files. There are usually many NSFs on any given Domino server. Each entry in the NSF may have a title, one or more body fields, and attachments. For example:

An NSF for email might have the fields: subject, to, from, bcc, body, and attachment.

An NSF for inventory management might have the fields: catalog number, title, description, and expiration date.

A fingerprinting task treats the body of a document and each of its attachments as a separate item. This enables the system to show the full path down to the item inside a document that caused a breach.

Important

To use this feature, you must first:

Install IBM Notes before installing TRITON AP-DATA. Notes must be on the same machine as the crawler. Be sure that the Notes installation is done for "Anyone who uses this computer."

Provide your Notes user ID file and password when prompted by the TRITON AP-DATA installer. This information is used to authenticate access to the Domino server for fingerprinting and discovery.

Log onto Notes, one time only, and supply a user name and password. This user must have administrator privileges for the Domino environment. (Read permissions are not sufficient.)

Connect to the Domino server from the Notes client.

See the TRITON AP-DATA Deployment Guide for step-by-step instructions.

Field

Description

Name

Enter a name for the documents you are fingerprinting, such as "finance documents."

Description

Enter a description of this set of documents.

Crawler

The "crawler" is the agent that scans your documents looking for sensitive data. You can have several in your network if you are managing many documents. From the drop-down list, select which crawler to use to perform this fingerprinting. Typically this would be the crawler that is closest in proximity to the file folder or Domino server.

Fingerprinting Mode

Select which type of fingerprinting to perform:

Sensitive content - Select this option to identify the content files and documents to fingerprint.

Ignored section - Select this option to identify parts of secured documents that the system should not analyze. This might include disclaimers, copyrights, and logos.

Ignored sections are immediately enforced for every fingerprint. You do not need to add Ignored Section classifiers to a rule or policy. The classifier filters out files that are being fingerprinted before they're fingerprinted.

Fingerprinting Method

Select a fingerprinting method:

Content similarity - Select this method to look for similarities between the scanned content and the file. This method provides greater security, because it detects sections of the document as well as exact file matches.

Exact match - Select this method when you are only interested in exact matches. That is, when you only care if the scanned contents match the binary signature for the entire file. This method is quicker, but if someone edits just 1 character in the file, it is no longer detected.

For large directory structures with many files, Forcepoint recommends you initially set up an exact match classifier for immediate protection, then go back and change it to content similarity.