DLP policies

To configure the Trellix DLP policies:

1. Click on the policy name in the Policies table.

2. In the policy settings page, go to DLP Configuration section and click Manage.

3. Integration Type: Select the integration type as Trellix Data Loss Prevention Network Prevent for on-premise or Trellix DLP for SaaS platform.

   Note

   For Trellix DLP integration, you only need to configure the Timeout value and Action Mapping. You can ignore the remaining fields mentioned below.

4. Hostname:

   Enter the IP/Hostname corresponding to your Trellix DLP appliance. Email Security - Cloud will use this hostname and the port below to use Trellix DLP Prevent API and connect to the Trellix DLP appliance.

   • If you have multiple appliances, you can configure a load balancer and use the hostname/IP corresponding to the load balancer.

   
   

5. Port: The default value for Port is 941.

6. Timeout:

   Select the Timeout value in minutes. The default value is 10 minutes. If Trellix DLP responds before timeout, the Email Security - Cloud action will be applied based on the response.

   • If the Trellix DLP host is unreachable or returns error, Email Security - Cloud will attempt to connect three more times at intervals of 2 minutes.

   • If the Trellix DLP does not respond before timeout, the Trellix DLP policy evaluation will be skipped to avoid further email delivery delays. A report of failed attempts will be added to email trace events.

7. Verify TLS:

   Select Verify TLS to enable TLS certificate verification for Email Security - Cloud using the Email Security - Cloud - Trellix DLP communication. Enabling this option ensures enhanced security.

   • If you are using self-signed certificates on the Trellix Data Loss Prevention Network Prevent, you can disable this option.

8. API Token:

   Click Configure to add or modify the API token for authentication. A pop-up window appears in which you can enter the required API token. Select Save to save the API token.

   Note

   The API Token based authentication is only supported for Trellix DLP versions 11.11.0 and above. API token is not required for older versions.

   All DLP versions behind the load balancer should be the same to avoid authentication issues.

   Once the policy is saved with the API token, the token will not be visible later and only first few identifying characters of the API Token will be shown in the policy configuration page.

9. Action Mapping:

   The Action Mapping section enables you to select an Email Security - Cloud action with respect to the action specified in the Trellix DLP Policy Rules.

   • For Trellix DLP integration, the actions available are: Block, Quarantine, No Action.

     The following Trellix DLP actions are the corresponding header values to X-RCIS-Action header in the Reaction section of the Trellix DLP rule in the Trellix Data Loss Prevention Network Prevent portal: Block, Bounce, Quarantine, Encrypt, Redirect, Notify.

   • In the Trellix DLP, if multiple rules are triggered, only the highest priority action will be applied to the message.

   Note

   Email Security - Cloud custom rules has priority over Trellix DLP policies. Trellix DLP policy will not be evaluated if the Email Security - Cloud custom rule action is Deliver or Drop.

   If Email Security - Cloud Action is selected as Drop or Quarantine for an email, the email will be marked for policy violation in the email trace events. You can search for these emails in the Email Trace page using the Policy Action filter.

10. Select Save to save your changes. Select Cancel to revert to previous settings.

11. Go back to the DLP Configuration page and click the Test button to verify the license and connectivity to Trellix DLP or your DLP Prevent appliance. Ensure that the validation test has passed before associating the DLP policy with a domain.

    Configure your DLP rules and assign those to policies and enable them in the Trellix ePO - SaaS platform before you test/associate the DLP policy with a domain. See Configuring DLP - SaaS rules for the instructions to prepare Trellix DLP for this integration.

    
    

    • If the Trellix DLP appliance hostname/IP on configured port is reachable from the Email Security - Cloud and a successful TLS connection is established with the host, the following notification appears.

      

    • For Trellix DLP, if you don't have the add-on license, you will not be able to associate the DLP policy with a domain and you will receive the following error.

      

    • If you are using a self-signed TLS certificate on the Trellix DLP appliance or the TLS certificate validation is failing, you will receive the following notification

      

    • If the Email Security - Cloud is unable to establish a TLS connection with the configured Trellix DLP appliance, you will receive the following notification.

      In this scenario, recheck the configured hostname/port and review the network firewall changes as mentioned in step 3.

      

    • If the entered API token is invalid, expired, revoked or deleted, corresponding API token related error will be shown.