Exception Wizard - Severity & Action

Administrator Help | Forcepoint DLP | Version 8.4.x

Custom Policy Wizard - Severity & Action

Use the Severity & Action tab of the exception wizard to configure a severity level and an action plan for conditions that match the exception.

Use the When the condition is matched, severity is field to specify the severity of incidents that match this exception. This overrides the rule's severity:

Low - Incidents that match this exception are of low importance. The policy breach is minor.

Medium - Incidents that match this exception are of medium importance. The policy breach is moderate.

High - Incidents that match this exception are very important and warrant immediate attention. The policy breach is severe.

Use the and the action plan is field to select an action for this exception. By definition, exceptions override the rule's action plan.

Select Block all to use the strict actions defined under Main > Policy Management > Resources > Action Plans.

Select Audit & notify manager (the default) to use the moderate actions defined. These are a compromise between the blocking and auditing plans.

Select Audit only to use audit incidents and not block them.

New and edit icons are displayed to the right of the action plan drop-down list.

Click the edit icon to change the action for each channel if desired. Editing an action plan changes it for all the rules and exceptions that use it.

Click the new icon to create a new action plan. See Action Plans.

Click Advanced to define severity at a more granular level.

Mark a check box and define the parameters as needed.

Under Define Matches, select how matches should be calculated for this exception:

Greatest number of matched conditions. Select this option if you want the number of matches for each condition to be compared, and only the greatest number reported. For example, if there are 5 matches for the condition, ConfidentialPattern, 3 for SSN_Pattern, and 10 for MyKeyPhrases, the number of matches would be defined as 10.

Sum of all matched conditions. Select this option if you want the number of matches for each condition to be added together and the total to be reported. Given the same example as above, the number of matches would be defined as 18.

Click Next to continue to the Finish page of the exception wizard. See Exception Wizard - Finish.