Network Discovery Rule - Box page

Rule options

Rule name

Enter a unique name for the rule. This field is required.

Description

Click Edit to open the description text box. The maximum description length is 2000 characters. The character counter in the lower left of the window shows the number of characters still available. This field is optional.

State

Select Enabled or Disabled from the drop-down list. You can also change this parameter on the DLP Rule Set page by selecting a rule or rules and selecting Actions → Change State. The default is Disabled.

Severity

A relative measure of the gravity of violating this rule. The default is Warning. The color code that also appears in the DLP Incident Manager is displayed next to the field.

Conditions tab

Classification

Specifies a predefined classification. Use the Boolean comparisons AND, OR, NOT to specify multiple classifications.

Using classification grouping — When you include multiple classifications in a rule, you can group classifications and create a custom expression to optimize a condition using the Boolean AND or OR operations. When more than two rows of conditions are included, a toggle button appears. Click the toggle button to enable custom classification grouping and type the custom classification grouping expression. For example, if classifications 1, 2, and 3 are included in a Classification condition, you can build an expression similar to ((1 AND 2) OR (1 AND 3)).

The expressions are simplified using the Boolean logic. The brackets are added automatically to the expression if not included. If an expression has both AND and OR, the classification item numbers with AND logic are grouped first and then the classification item numbers with OR logic are grouped. The AND operation takes precedence over the OR operation and the expression is computed from left to right. A classification grouping expression must include all classification item numbers.

Repository

Specifies the repository scanned.

File Sharing

Specifies which files to scan based on how the file is shared.

Exceptions tab

Note

The Exceptions tab is optional.

Actions

Adds or deletes a rule exception.

Name

Enter a unique name for the exception. This field is required.

Description

Optional descriptive text.

State

Select Enabled or Disabled from the drop-down list. The exception state is independent from the rule state.

Classification

Select a classification. See above for option details. The exception classification is independent from the rule classification.

Using classification grouping — When you include multiple classifications in a rule, you can group classifications and create a custom expression to optimize a condition using the Boolean AND or OR operations. When more than two rows of conditions are included, a toggle button appears. Click the toggle button to enable custom classification grouping and type the custom classification grouping expression. For example, if classifications 1, 2, and 3 are included in a Classification condition, you can build an expression similar to ((1 AND 2) OR (1 AND 3)).

The expressions are simplified using the Boolean logic. The brackets are added automatically to the expression if not included. If an expression has both AND and OR, the classification item numbers with AND logic are grouped first and then the classification item numbers with OR logic are grouped. The AND operation takes precedence over the OR operation and the expression is computed from left to right. A classification grouping expression must include all classification item numbers.

Repository

Select a repository to exclude from the rule.

File Sharing

Select files to be excluded from the rule.

User Account (Email)

Specifies accounts to exclude from triggering the rule.

Reaction tab

Action

Select an action from the drop-down list. The default is No Action.

Note

Selecting No Action with Report Incident is sometimes referred to as Monitor.

For a list of prevent actions for different types of rules, see the available reactions table.

Report Incident

Select the checkbox for the rule to trigger a DLP incident.

Store Original File

Select to store the original file as evidence. If the hit highlighting option is enabled for the evidence server, the trigger text is highlighted and stored as a separate file.