Add an Enterprise DLP Email Policy Rule

Log in to
Strata Cloud Manager
.
(
Optional
) Create custom data patterns and data profiles to specify custom match criteria.
Skip this step if you want to use the predefined
Enterprise DLP
data profiles available by default.
Create custom data patterns and custom document types as needed.
Create a data profile.
Select
Manage
Configuration
SaaS Security
Data Security
Policies
Email DLP Policies
and
Add Policy
.
Configure the Basic Information of the email DLP policy.
Enter a descriptive
Name
.
Specify the Evaluation Priority of the email DLP policy.
This Evaluation Priority determines the order email DLP policies are evaluated.
Select whether the new email DLP policy goes
before
or
after
an existing email DLP policy.
For the Email Application, select
Microsoft Exchange
or
Gmail
.
Select the
Enterprise DLP
incident severity for when
Enterprise DLP
detects matching traffic.
Select the
DLP Data Profile
to associate with the email DLP policy.
The DLP data profile you select is used as the traffic match criteria that
Enterprise DLP
evaluates inspected traffic against. The data profile can be either a predefined data profile or a custom data profile.
Verify that
Enable Policy
is toggled on.
This setting is enabled by default when you add a new email DLP policy.

(
Optional
) Configure the DLP email policy
Conditions
.
The DLP email policy conditions determine the email sender and recipient criteria for when inline inspection of email traffic should or should not be performed by
Enterprise DLP
. The Email DLP policy conditions have an
AND
relationship. This means that all email sender and recipient
Conditions
you configure must be met for
Enterprise DLP
to take action.
You can configure all or only some of the DLP email policy conditions settings as needed. If no email sender or recipient conditions are configured, then all outbound email traffic is inspected by
Enterprise DLP
and evaluated against the data profile you selected in the previous step.
For example, you configure the Email DLP policy conditions to inspect for the
yourcompany.com
Sender Email Domain
and
gmail.com
Recipient Email Domain
only. For
Enterprise DLP
to take action, the email sender domain and recipient email domain must match what you have configured. In this instance,
Enterprise DLP
does not take action if the
Recipient Email Domain
is
yahoo.com
.
Configure the email
Sender
conditions.
To configure the email sender conditions you must specify whether the conditions are inclusive or exclusive of the specified email domains, user groups, or specific users.
Is one of
—Inclusion condition to evaluate emails sent from an email associated with the selected email domains, user groups, or specified users against the data profile specified in the DLP email policy.
Any emails that are not a part of the selected email domains, user groups, or specified users are not evaluated against the data profile associated with the DLP email policy.
Is not one of
—Exclusion condition to evaluate emails sent from an email not associated with the selected email domains, user groups, or specified users against the data profile specified in the DLP email policy.
Any emails that are part of the selected email domains, user groups, or specified users are not evaluated against the data profile associated with the DLP email policy.
Specify the
Sender Email Domain
condition and select one or more email domains.
The sender email domains available to select are those you added when you connected Microsoft Exchange or Gmail.
Specify the
Sender User Group
condition and select one or more user groups.
The sender user groups are obtained from your Client Identity Engine (CIE) configuration. Skip this step if you do not have CIE active on
Strata Cloud Manager
.
Specify the
Sender User
condition and enter an email.
Click add ( ) to include additional sender emails.
Configure the email
Recipient
conditions.
To configure the email recipient conditions, you must specify whether the conditions are inclusive or exclusive of the specified email domains or specific users.
Is one of
—Inclusion condition to evaluate emails to be received by an email associated with the selected email domains or specified users against the data profile specified in the DLP email policy.
Any emails that are not a part of the selected email domains or specified users are not evaluated against the data profile associated with the DLP email policy.
Is not one of
—Exclusion condition to evaluate emails to be received by an email not associated with the selected email domains or specified users against the data profile specified in the DLP email policy.
Any emails that are part of the selected email domains or specified users are not evaluated against the data profile associated with the DLP email policy.
Specify the
Recipient Email Domain
condition and enter a valid email domain.
Enterprise DLP
supports all valid email domains. The email domain is the web address that follows the
@
symbol in an email address. For example,
gmail.com
or
yahoo.com
.
Click add ( ) to include additional email domains.
Specify the
Recipient User
condition and enter an email.
Click add ( ) to include additional recipient emails.
Configure the email components
Enterprise DLP
needs to
Evaluate
.
Enterprise DLP
can inspect and evaluate the
Email Subject
,
Email Body
, and
Email Attachment(s)
as needed. You can select one, two, or all available evaluation criteria. At least one evaluation criteria must be selected to save the Email DLP policy rule.

Configure the DLP email policy
Response
.
The DLP email policy response configuration specifies the action
Enterprise DLP
takes when inspected traffic matches the data profile associated with the policy.
Specify the
Action
Enterprise DLP
takes when inspected traffic matches the data profile associated with the policy.
Monitor
—Outbound email is allowed to leave your organization to the intended recipient. A DLP incident is generated
Block
—Outbound email is blocked from leaving your organization's network.
The action Microsoft Exchange or Gmail takes on a
Block
verdict rendered by
Enterprise DLP
is based on the block transport rule you created.
Quarantine
—Outbound email is transported back to the email server and quarantined. The email is forwarded to the hosted quarantine spam inbox and requires review by an email administrator before the email is allowed to leave your organization's network.
The action Microsoft Exchange or Gmail takes on a
Quarantine
verdict rendered by
Enterprise DLP
is based on the quarantine transport rule you created.
(
Microsoft Exchange only
)
Forward email for approval by end user's manager
—Outbound email is transported back to Microsoft Exchange and sent to the sender's manager for approval. Independent review is required by the sender's manager before the email is allowed to leave your organization's network.
The action Microsoft Exchange takes on a
Forward email for approval by end user's manager
verdict rendered by
Enterprise DLP
is based on the transport for manager approval rule you created.
(
Microsoft Exchange only
)
Forward email for approval admin
—Outbound email is transported back to Microsoft Exchange and sent to the specified email admin for approval. Independent review is required by the specified email administrator before the email is allowed to leave your organization's network.
The action Microsoft Exchange takes on a
Forward email for approval admin
verdict rendered by
Enterprise DLP
is based on the transport for admin approval rule you created.
(
Microsoft Exchange only
)
Encrypt
—Outbound email is allowed to leave your organization and is transported back to Microsoft Exchange to be encrypted before continuing its path to the intended recipient.
The action Microsoft Exchange takes on a
Encrypt
verdict rendered by
Enterprise DLP
is based on the encrypt transport rule you created.
(
Optional
) Automatically assign an
Incident Assignee
when
Enterprise DLP
renders a
Block
or
Quarantine
verdict on matching traffic.
Strength your security posture by assigning an incident assignee to follow up on and resolve events where
Enterprise DLP
detects outbound emails that contain sensitive information.
(
Optional
) Add emails to send
Notifications
to receive alerts when
Enterprise DLP
renders
Block
or
Quarantine
verdicts on inspected outbound traffic.
Click add ( ) to include additional emails to receive notifications.

Save Policy
.