An organization wants to block all removable devices in the company, while maintaining a list of specific devices that are trusted. Also, specific content needs to be blocked on all devices, including the trusted ones.
An administrator needs to perform these tasks.
Block all removable devices in the organization with the Removable Storage Device Rule.
In ePO - SaaS, select Menu → Data Protection → DLP Policy Manager.
On the Rule Sets tab, select or create a rule set. For new rule sets, make sure to assign a policy.
On the Device Control tab, select Actions → New Rule → Removable Storage Device Rule.
Enter a name for the rule and select State → Enabled.
In the Conditions section, select the built-in Removable storage devices (Windows) value in the Removable Storage field.
On the Reaction tab, select Action → Blocked. Select the Report Incident option.
From the User Notification list, select Default device management user notification and click OK.
Click Save, then click Close.
Identify trusted devices and create a device template.
In Trellix ePO - SaaS, select Menu → Data Protection → Protection Workspace and click the Incidents list.
In the Filter By pane, under Incident Type, select Device Plug.
Click the Incident ID of a device you want to set as trusted to verify Endpoint Details and Additional Information about the device. From here you can obtain specific details about the device, such as the serial number.
Click OK to return to the Incidents list.
Select the checkbox next to the incident and select Create Device Template → Removable Storage Device.
Enter a name for the device template and click Save. Repeat steps e and f for each of your trusted devices.
Select DLP Policy Manager → Definitions.
In the left pane, select Device Control → Device Templates.
Select Actions → New Group → Removable Storage Device Group.
Enter a name for the group, such as, Trusted devices. Add one or more device templates created in steps e and f and click Save.
Add trusted devices to the Removable Storage Device Rule created in step 1.
Select DLP Policy Manager.
On the Rule Sets tab, select Device Control tab and then the rule set created in step 1.
On the Exceptions tab, select Excluded Device Templates (Disabled) and then select the device template group created in step 2.
Select State → Enabled.
Assign rule sets to policies.
Select DLP Policy Manager → Policy Assignment
Select the policy name and select Actions → Apply selected policies.
Make sure the revision is incremented and there are no pending changes.