Tuning policies

Users are sometimes plagued by slow performance when a new policy is enforced. One cause might be high CPU usage. To determine this, go to the Process Listtab. If you see an unusually large number of events for a process, this could be the problem. For example, a recent check found that taskmgr.exe was classified as anEditor, and had the second highest number of total events. It is quite unlikely that this application is leaking data, and the Trellix DLP Endpoint client does not need to monitor it that closely.

To test the theory, create an application template. In the Policy Catalog, go to DLP Policy → Settings and set an override to Trusted. Apply the policy, and test to see if performance has improved.

Tagging sensitive data lies at the heart of a data protection policy. Diagnostic Tool displays information that helps you design effective content classification and content fingerprinting criteria. Tags can be too tight, missing data that should be tagged, or too loose, creating false positives.

The Active Policy page lists classifications and their content classification and content fingerprinting criteria. The Data Flow page lists all tags applied by the policy, and the count for each. When counts are higher than expected, false positives are suspected. In one case, an extremely high count led to the discovery that the classification was triggered by Disclaimer text. Adding the Disclaimer to the ignored list removed the false positives. By the same token, lower than expected counts suggest a classification that is too strict.

If a new file is tagged while the Diagnostic Tool is running, the file path is displayed. in the details pane. Use this information to locate files for testing.