Protecting files with discovery rules

Discovery rules define the content that Trellix DLP Endpoint - SaaS searches for when scanning repositories and determine the action taken when matching content is found. Discovery rules can be defined for Trellix DLP Discover – SaaS or for Trellix DLP Endpoint - SaaS discovery.

Depending on the type of rule, files matching a scan can be copied, moved, classified, quarantined, content fingerprinted, or have a rights management policy applied. All discovery rule conditions include a classification.

Note

When using email storage discovery rules with the Quarantine prevent action, verify that the Outlook Add-in is enabled (Policy Catalog → Data Loss Prevention → Client Configuration → Operational Modes and Modules). You can't release emails from quarantine when the Outlook Add-in is disabled.

Note

Trellix DLP Discover – SaaSrules also require a repository. See the chapter Scanning data with Trellix DLP Discover – SaaS for information on configuring rules and scans.

End-user initiated scans

When activated in the DLP Policy local file system scan configuration, end-users can run enabled scans and can view self-remediation actions. Every scan must have an assigned schedule, and the scan runs according to the schedule whether the user chooses to run a scan. But when the user interaction option is enabled, the end-users can also run scans at their convenience. If the self-remediation option is also selected, end-users can also perform remediation actions.

Local file system automatic classification

When the Classify File action is chosen for local file system discovery rules, the rule applies automatic classification, and embeds the classification Tag ID into the file format. The ID is added to all Microsoft Office and PDF files, and to audio, video, and image file formats.