Create a rule tuning search that you can save as a new email, web, or network communication protection rule, or override an existing rule.
Check that the user has permissions to use DLP Policy Manager.
In ePO - On-prem, select Menu → DLP Capture, and create a new rule tuning search or identify an existing rule tuning search that you want to save.
In the Search List, select the rule tuning search that you want to save, then select Actions → Save as Rule.
Select one of the following options, then click OK.
Create new Rule — (Default) Either select an existing rule set to save the rule to, or create a new one.
Override existing Rule — (Optional) This option becomes available if this search was originally created by saving a rule, or the search was saved as a new rule and you want to update it. Select it to save the new version of the rule over the existing rule. You can choose to keep the existing name and description or create new ones.
On the rule page, specify the reaction, severity, and state settings, then click Save.
The rule appears in the rule set in the DLP Policy Manager.
(Optional) If you want to make further changes to the rule without affecting your live data analysis, you can select it in the rule set and click Save as Capture Search. You can repeat this process of saving the rule as a capture search and making changes until you are satisfied with the new rule settings.