Use case: Limit emails to external email address domains using Recipient Domain Threshold settings

In Trellix ePO - On-prem, go to Menu → Data Protection → DLP Policy Manager.

Set the recipient domain threshold limit.

1. Click the Definitions tab.

2. In Source/Destination, select Recipient Domain Threshold.

3. Click Actions → New Item.

4. Enter a name and optional description.

5. In Available properties, click Domains to be excluded.

6. Select equals to, then click the three-dots menu to select the domain names that need to be excluded.

   Note

   You can create the domain definitions in Definitions → Email Address List.

7. In Available properties, click Threshold*, then click + to add the threshold value for To, Cc, and Bcc.

8. Click Save.

Configure the Email Protection rule.

1. In the Rule Sets tab, create a rule set. For more information, see Create a rule set.

2. Open the created rule set, then in the Data protection tab, select Actions → New Rule → Email Protection.

3. Enter a name for the rule and select State → Enabled.

4. On the Conditions tab, for Recipient Domain Threshold, select equals to to select the threshold definition created in step 2.

5. Click the three-dots menu to select the email threshold criteria created in step 2.

6. Provide the other conditions and exceptions (optional).

7. On the Reaction tab, from the Actions drop-down, select the action as needed.

   You can optionally add a user notification, select the Report Incident option, or select a different action when disconnected from the corporate network.

8. Click Save and Close.

Assign rule sets to a policy. Before you assign rule sets to a policy, activate the rule set.

1. Go to Menu → Policy → Policy Catalog.

2. In the Product drop down list, select Data Loss Prevention <version> and select DLP Policy.

3. Click the Edit link of the policy you want to update.

4. In the policy page, go to Active Rule Sets → Actions, then click Activate Rule Set.

   The Activate Rule Set window opens.

5. Select the checkboxes of one or more rule sets that you want to apply to the policy.

6. Click OK and click Apply Policy.

   Trellix DLP – SaaS displays the status of the policy applied.

Assign and push the policy to Trellix DLP – SaaS endpoints.

1. Go to Menu → Systems → System Tree.

2. Select the checkbox of one or more systems that you want to assign the policy to.

3. Click Wake Up Agents to push the policy to Trellix DLP – SaaS endpoints immediately.

   The Wake Up McAfee Agent window opens.

4. Next to Wake-up call type, select whether to send an Agent Wake-Up Call or a SuperAgent Wake-Up Call.

5. Accept the default Randomization (0–60 minutes) or type a different value.

   If you type 0, agents respond immediately.

6. Click OK to send the wake-up call to the endpoints.

Or, you can use the Break inheritance and assign the policy and settings below option to push the policy. For information, see Assign and push a policy to a system.