Outbound email messages are blocked if they contain the word Confidential. The email message is not sent to the recipient from the Smart Host. A notification mail with the original email as an attachment is sent back to the sender. You can choose a predefined user notification or customize the definition. In addition, more details about the blocked email message are attached to the notification in HTML file format.
Create a rule set with an Email Protection rule.
In ePO - SaaS, select Data Protection → DLP Policy Manager.
Click Rule Sets, then select Actions → New Rule Set.
Name the rule set
Block email and return to sender.Create a duplicate copy of the in-built Confidential classification.
An editable copy of the classification appears.
Click Actions → New Rule → Email Protection Rule.
Name the new rule Bounce email and enable it.
Enforce the rule on DLP Network Prevent.
Select the classification you created and add it to the rule.
Leave the other settings on the Condition tab with the default settings.
Configure the reaction to messages that contain the word Confidential.
Click Reaction.
In DLP Network Prevent, select Actions → Block and return email to sender.
Select the notification that has to be sent from User Notification.
(Optional) To report an incident, about the bounced email message, select the Report Incident checkbox. To save the evidence, select the Store original email as evidence checkbox.
Save and apply the policy.
Set the sender email address for the bounced email messages.
Open the Policy Catalog.
Select the DLP Appliance Management product, select the Trellix DLP Network Prevent Email Settings category, and open the policy that you want to edit.
Specify the sender email address in the Bounce Messages Sender field. It must be a generic email address.
Click Save.