DLP Capture setup workflow

The DLP Capture feature enables you to store and filter email and web data analyzed by your Trellix DLP Network Prevent appliances.

DLP Capture is an optional feature that you enable from ePO - On-prem. On Trellix DLP 8800, Trellix DLP 7700, Trellix DLP 6600 and virtual appliances, there must be sufficient storage disk space available at the time of software installation. If you want to increase the capture disk size later, reinstall the appliance software to detect the capture storage disk.

You can enable the DLP Capture feature for your Trellix DLP appliance from the Trellix DLP Appliance Management extension in ePO - On-prem.

Note
The option to enable DLP Capture in ePO - On-prem does not appear on the interface until you add a Trellix DLP Network Prevent license.

The captured data is stored on a disk on a physical or virtual appliance, or on an external storage device.

Appliance type	Capture storage description
Trellix DLP 8800 appliance model Trellix DLP 7700 appliance model Trellix DLP 6600 appliance model	The captured data is stored in Trellix DLP Capture Storage Array, which is an external storage device and can hold up to 24 TB of data. Note Each Trellix DLP 8800, Trellix DLP 7700, or Trellix DLP 6600 appliance on which you want to enable DLP Capture must have a dedicated Trellix DLP Capture Storage Array connected to it to store the captured data.
Virtual appliance	You can use the DLP Capture feature on virtual appliances when deployed using a capture enabled virtual machine.

Appliance type

Capture storage description

Trellix DLP 8800 appliance model

Trellix DLP 7700 appliance model

Trellix DLP 6600 appliance model

The captured data is stored in Trellix DLP Capture Storage Array, which is an external storage device and can hold up to 24 TB of data.

Note
Each Trellix DLP 8800, Trellix DLP 7700, or Trellix DLP 6600 appliance on which you want to enable DLP Capture must have a dedicated Trellix DLP Capture Storage Array connected to it to store the captured data.

Virtual appliance

You can use the DLP Capture feature on virtual appliances when deployed using a capture enabled virtual machine.

Note
If DLP Capture is enabled on an appliance, you might experience some impact on the performance when the appliance copies data during data scanning.

For Trellix DLP 8800, Trellix DLP 7700, and Trellix DLP 6600 appliance, set up the storage disk to save the captured data.
Complete the installation of the Trellix DLP Network Prevent appliance software.
For the appliance to be managed, register the appliance with ePO - On-prem from the Setup Wizard.
Integrate Trellix DLP Network Prevent with the Smart Host (MTA server) that supports header inspection and configure the policy to work with Trellix DLP Network Prevent.
Integrate Trellix DLP Network Prevent with the web proxy server and configure the policy to work with Trellix DLP Network Prevent.
Choose to use the Trellix DLP Network Prevent appliance for either email analysis or scanning web traffic, but not for both. Web users experience delays (except in small environments) when you use the same appliance for both email analysis and web traffic scanning.
Enable the DLP Capture feature and set how long you want to retain the captured data for.