This section provides examples of data policy rules and examples that illustrate the effects of both data policy rules and visibility settings.
The following examples show rule constraints, including their syntax and a brief description.
class DOES NOT EQUAL Trellix_nx_alert
class!=Trellix_nx_alertUsers with this data policy will be unable to see Network Security alert data.
product DOES NOT EQUAL hx
product!=[hx]Users with this data policy will be unable to see Endpoint Security (HX) appliances on the Appliances, Appliance Groups, and Appliance Settings pages.
class DOES NOT EQUAL appliance_health AND class DOES NOT EQUAL Trellix_ex_alert AND meta_cbid EQUALS 12345
class!=appliance_health AND class!=Trellix_ex_alert AND meta_cbid=12345Users with this data policy will be unable to see health data and Email Security — Server alert data for Comm Broker 12345.
class EQUALS Trellix_nx_alert OR class=Trellix_ex_alert
class=Trellix_nx_alert OR class=Trellix_ex_alertUsers with this data policy will only be able to see Network Security alert data and Email Security — Server alert data.
class DOES NOT EQUAL ms_windows_event
class!=ms_windows_eventUsers with this data policy will be unable to see Windows event logs.
class EQUALS Trellix_hx AND deviceid EQUALS 0123456789
class=Trellix_hx AND deviceid=0123456789Users with this data policy will only be able to see Endpoint Security (HX) data from the device with the specified ID.
class EQUALS appliance_health,Trellix_hx AND deviceid EQUALS 1234,5678
class=[appliance_health,Trellix_hx] AND deviceid=[1234,5678]Users with this data policy will only be able to see health or Endpoint Security (HX) data from either of the two specified devices.
The following examples illustrate how visibility settings and data policies control user access.
An archive search with public visibility uses class=Trellix_nx_alert and class=Trellix_ex_alert in its search criteria. A user who is restricted from seeing Network Security alert data can see the search on the Archive Searches page and see both Network Security and Email Security — Server Edition data from the View Results menu item, which returns the cached data from the owner's initial execution. If the restricted user reruns the search, the new search results will exclude the Network Security data, according to that user's data policy.
An archive search with public visibility uses class=Trellix_hx_alert in its search criteria. A user who is restricted from seeing Endpoint Security alerts can see the search on the Archive Searches page and see Endpoint Security data from the View Results menu item for that search, which returns the cached data from the owner's initial execution. If the restricted user reruns the search, a "not found" message is displayed, according to that user's data policy.
A user is restricted from a certain sensor, based on a policy rule defined with constraint meta_cbid!=[xxx]. That user's view of the Sensors page will exclude that sensor.
A report has private visibility. Only the report owner and organization admin will see the report on the Reports page.
A user-created custom dashboard with public visibility uses class=Trellix_etp in the query for one of the widgets. A user who is restricted from seeing Email Security - Cloud data can see the widget in the custom report the owner created. If the restricted user clones the dashboard, the new dashboard will exclude that widget, according to that user's data policy.