Save an email, web, or network communication protection rule as a rule tuning search to experiment with its settings without affecting your live data analysis. You can save the new version of the rule back to your active rules as a new rule, or replace the existing rule.
Note
Saving an email, web, or network communication protection rule as a rule tuning search is only supported for rules that are enforced on Trellix DLP Network.
In ePO - On-prem, select Menu → Data Protection → DLP Policy Manager.
Click the Rule Sets tab.
Select the rule set that contains the rule you want to save, then select the rule from the data protection rules.
The rule must be enforced on a Trellix DLP Network system.
Select Actions → Save as Capture Search.
On the Capture Search → Rule Tuning page, edit the settings to tune the rule.
Click Save or Save and Run.
When the search event shows Finished, check the results to see if you need to make further changes.
When you are satisfied that the rule is getting the results you want, click Actions → Save as Rule, and either create a new rule from it, or override the original rule in the rule set.