You can use the DLP Capture feature to tune your classifications and the email protection, web protection, and network communication protection rules enforced on Trellix DLP Network to prevent false positives or negatives. The rule tuning feature analyzes captured data rather than active data so you can edit the rule or classification settings until it returns the type of results you want, without affecting your live data analysis.
You can either save an existing rule as a rule turning search, tune it, then use it to override an existing rule, or create a rule tuning search before creating a new rule, tune the settings until you are satisfied with the results, and save it as a new rule.
If you choose to override an existing rule, the Enforced on and Reactions options stay the same.
Rules that can be tuned
Rule | Trellix DLP Network Prevent | Trellix DLP Network Monitor |
|---|---|---|
Email Protection | Yes | Yes |
Web Protection | Yes | Yes |
Network Communication Protection | No Tuning a network communication protection rule on Trellix DLP Network Prevent Network fails with the reason Rule Type Not Applicable. | Yes |
Important
If you change classification settings or definitions in a rule tuning search, those changes are applied to the settings in the equivalent active items. For example, if you add a term to a classification in a rule tuning search, it might trigger the active rule. Trellix recommends that you duplicate the classification or definition and use the duplicate while you are tuning the rule. You can then use it to replace the original item in the active rules when you have the results you want.