Rules allowing evidence storage

These rules have the option of storing evidence.

Evidence saved by Trellix DLP Network Monitor – SaaS or Trellix DLP Network Prevent – SaaS rules

Rule	What is saved
Email Protection Rule	Copy of the email
Network Communication Protection Rule	Copy of the content
Web Protection Rule	Copy of the web post

Evidence saved by Trellix DLP Endpoint - SaaSrules

Rule	What is saved
Application File Access Protection Rule	Copy of the file
Clipboard Protection Rule	Copy of the clipboard
Cloud Protection Rule	Copy of the file
Email Protection Rule	Copy of the email
Network Share Protection Rule	Copy of the file
Printer Protection Rule	Copy of the file
Removable Storage Protection Rule	Copy of the file
Screen Capture Protection Rule	JPEG of the screen
File System Discovery Rule	Copy of the file
Email Storage Discovery Rule	Copy of the .msg file
Web Protection Rule	Copy of the web post

Evidence saved by Trellix DLP Discover – SaaS rules

Rule	What is saved
File Server Protection Rule	Copy of the file