Rules allowing evidence storage

Published on Sep 1, 2026

1 minute(s) read

Article summary

These rules have the option of storing evidence.

Evidence saved by Trellix DLP Network Monitor or Trellix DLP Network Prevent rules

Rule	What is saved
Email Protection Rule	Copy of the email
Network Communication Protection Rule	Copy of the content
Web Protection Rule	Copy of the web post

Evidence saved by Trellix DLP Endpoint rules

Rule	What is saved
Application File Access Protection Rule	Copy of the file
Clipboard Protection Rule	Copy of the clipboard
Cloud Protection Rule	Copy of the file
Email Protection Rule	Copy of the email
Network Share Protection Rule	Copy of the file
Printer Protection Rule	Copy of the file
Removable Storage Protection Rule	Copy of the file
Screen Capture Protection Rule	JPEG of the screen
File System Discovery Rule	Copy of the file
Email Storage Discovery Rule	Copy of the .msg file
Web Protection Rule	Copy of the web post

Evidence saved by Trellix DLP Discover rules

Rule	What is saved
Box Protection Rule	Copy of the file
File Server Protection Rule	Copy of the file
SharePoint Protection Rule	Copy of the file
Database Protection Rule	Copy of the table

Was this article helpful?