Use case: Block outbound messages with confidential content unless they are sent to a specified domain

Create an email address list definition for a domain that is exempt from the rule.

1. In the Data Protection section in ePO - SaaS, select DLP Policy Manager and click Definitions.

2. Select the Email Address List definition and create a duplicate copy of the built-in My organization email domain.

3. Select the email address list definition you created, and click Edit.

4. In Operator, select Domain name is and set the value to example.com.

5. Click Save.

Create a rule set with an Email Protection rule.

1. Click Rule Sets, then select Actions → New Rule Set.

2. Name the rule set Block Confidential in email.

3. Create a duplicate copy of the built-in Confidential classification.

   An editable copy of the classification appears.

4. Click Actions → New Rule → Email Protection Rule.

5. Name the new rule Block Confidential and enable it.

6. Enforce the rule on Trellix DLP Endpoint for Windows.

7. Select the classification you created and add it to the rule.

8. Set the Recipient to any recipient (ALL).

   Leave the other settings on the Condition tab with the default settings.

Add exceptions to the rule.

1. Click Exceptions, then select Actions → Add Rule Exception.

2. Type a name for the exception and enable it.

3. Set the classification to Confidential.

4. Set Recipient to at least one recipient belongs to all groups (AND), then select the email address list definition you created.

Configure the reaction to messages that contain the word Confidential.

1. Click Reaction.

2. Set the Action to Block for computers connected to and disconnected from the corporate network.

Save and apply the policy.