Workflow to define a web user list

Trellix DLP Network Prevent allows you to create or update non-LDAP or non-Active Directory-based web user lists, which you can use in Web Protection rules. You can use these web user lists in rules to apply specific data protection policies to the required web users. For example, you can update a RIF list or privileged user list information that is imported in a specific data policy. This feature enables you to import or add, edit, or modify a web user list within the policies.

Use this workflow to create and include a web user list in a classification criteria.

Rules for creating Usernames and UserPrincipleNames

Trellix DLP checks for these properties to verify different Usernames and UserPrinciplenames. Usernames and UserPrincipalNames are not case sensitive.

Exceptions: When creating a group, the number sign (#) can be used as part of the group's name. However, the email address you create for a distribution group or shared mailbox cannot use the # sign.

A domain name can consist of a prefix (the user account name) and a suffix. The prefix is joined with the suffix using the "@" symbol. For example, someone@example.com

Authentication schemes supported in ICAP header for web user list evaluation

Trellix DLP Network Prevent authenticates the web users sending the request from the web proxy via the X-Authenticated-User header in an ICAP request. Trellix DLP Network Prevent appliance supports NTLM, WINNT, and LOCAL authentication schemes to process the X-Authenticated-User header in an ICAP request for web user list evaluation. Specify the X-Authenticated-User header in the following format.

Note

KERBEROS authentication scheme to process the X-Authenticated-User header in an ICAP request for web user list evaluation isn't supported.