Use case: Prevent exposing external email domains and email recipients in To or Cc fields when sending an email

In ePO - On-prem, go to Menu → Data Protection → DLP Policy Manager.

Set the recipient threshold limit.

1. Click the Definitions tab.

2. In Source/Destination, select Recipient Threshold.

3. Click Actions → New Item.

4. Enter a name and optional description.

5. In Available properties, click Domain Threshold* or Email Recipient Threshold* , then select the threshold value for To, Cc, Bcc, Cumulative, and Cumulative (Ignore Bcc). You can also add different domain or email threshold using +.

   Note

   The minimum value that can be entered as a threshold for domain and email recipient is 1.

   Note

   Either Domain Threshold* or Email Recipient Threshold* criteria is allowed in creating a rule.

6. In Available properties, click Exclusions.

   Note

   These domains and email recipients can be internal.

   Note

   For Exclusions, when using Domain threshold criteria only the domain name value is considered and both the email address and display name are ignored.

7. Select equals to, then click the three-dots menu to select the email addresses, email address expressions, display names, characters contained in display name, and domain names that need to be excluded.

   Note

   You can create the domain or email recipient definitions in Definitions → Email Address List.

8. Click Save.

Configure the Email Protection rule.

1. In the Rule Sets tab, create a rule set. For more information, see Create a rule set.

2. Open the created rule set, then in the Data protection tab, select Actions → New Rule → Email Protection.

3. Enter a name for the rule and select State → Enabled.

4. On the Conditions tab, for Recipient Threshold (can be domain threshold or email recipient threshold), select equals to to select the threshold definition created in step 2.

   Note

   When Recipient Threshold is enabled, other classification criteria conditions and Exceptions are disabled.

5. Click the three-dots menu to select the email threshold definitions created in step 2.

On the Reaction tab, from the Actions drop-down, select the action as needed.

You can optionally add a user notification, select the Report Incident option, or select a different action when disconnected from the corporate network.

1. Click Save and Close.

Assign rule sets to a policy. Before you assign rule sets to a policy, activate the rule set.

1. Go to Menu → Policy → Policy Catalog.

2. In the Product drop down list, select Data Loss Prevention <version> and select DLP Policy.

3. Click the Edit link of the policy you want to update.

4. In the policy page, go to Active Rule Sets → Actions, then click Activate Rule Set.

   The Activate Rule Set window opens.

5. Select the checkboxes of one or more rule sets that you want to apply to the policy.

6. Click OK and click Apply Policy.

   Trellix DLP displays the status of the policy applied.

Assign and push the policy to Trellix DLP endpoints.

1. Go to Menu → Systems → System Tree.

2. Select the checkbox of one or more systems that you want to assign the policy to.

3. Click Wake Up Agents to push the policy to Trellix DLP endpoints immediately.

   The Wake Up Trellix Agent window opens.

4. Next to Wake-up call type, select whether to send an Agent Wake-Up Call or a SuperAgent Wake-Up Call.

5. Accept the default Randomization (0–60 minutes) or type a different value.

   If you type 0, agents respond immediately.

6. Click OK to send the wake-up call to the endpoints.

Or, you can use the Break inheritance and assign the policy and settings below option to push the policy. For information, see Assign and push a policy to a system.