Discovery scans crawl the local file system or mailboxes for sensitive content.
Verify that the rule sets you want to apply to the scans have been applied to the DLP Policy. This information is displayed on the DLP Policy → Rule Sets tab.
Changes in discovery setting parameters take effect on the next scan. They are not applied to scans already in progress.
In ePO - SaaS, select Menu → Policy → Policy Catalog.
Select Product → Data Loss Prevention <version>, then select the active DLP Policy.
On the Endpoint Discovery tab, select Actions → New Endpoint Scan, then select either Local Email or Local File System.
Note
Trellix DLP Endpoint – SaaS for Mac only supports local file system scans.
Enter a name for the scan, then select a schedule from the drop-down list.
Optional: Change the Incident Handling and Error Handling defaults. Set the State to Enabled.
Error handling determines what to report when text can't be extracted.
(Optional) For local file system scans, select the checkbox in the User Interaction field to allow the user to run enabled scans before they are scheduled. You can also enable the user to perform remediation actions from the Trellix DLP Endpoint - SaaS client console.
On the Folders tab, do one of the following:
For file system scans, select Actions → Select Folders. Select a defined folder definition or click New Item to create one. Define the folder as Include or Exclude.
For email scans, select the file types (OST, PST) and the mailboxes to be scanned.
Note
Trellix DLP Endpoint – SaaS for Mac only supports local file system scans.
(Optional) On the Filters tab (file system scans only) select Actions → Select Filters. Select a file information definition or click New Item to create one. Define the filter as Include or Exclude. Click OK.
The default is All Files. Defining a filter makes the scan more efficient.
On the Rules tab, verify the rules that apply.
All discovery rules from rule sets applied to the policy are run.