Create an Endpoint DLP Peripheral Control Policy Rule

1. Log in to Strata Cloud Manager.
2. Select ConfigurationData Loss PreventionEndpoint DLP Policy and click Add Policy.
3. Configure the Basic Information.

   1. For the Policy Type, select Peripheral Control.
   2. Enter a descriptive Name for the Endpoint DLP policy rule.
   3. (Optional) Enter a Description to describe the Endpoint DLP policy rule.
   4. Choose the Severity of the Enterprise DLP incident when a user accesses a blocked peripheral device.
   5. Enable Policy is enabled by default and enables the Endpoint DLP policy rule after you save.

      Disable this setting if you don't want to immediately enable the Endpoint DLP policy rule after creation.
   6. Click Next to continue.
4. Configure the Scope to define which users and endpoint channels the policy rule applies to.

   For Enterprise DLP to take the configured Response action, both Users and Endpoint Channels must be matched.

   1. Select the Users the policy rule applies to.

      • Any Users & Groups
        Apply the policy rule to all users. You can Exclude one or more users from the policy rule.
      • Select Users
        Apply the policy rule to specific users and groups. You can apply the rule to specific users, user groups, or both.
        Include
        • Select Users—Select one or more specific users the rule applies to.
        • Select Groups—Select one or more user groups the rule applies to.
        Exclude—Select one or more users to exclude from the policy rule. You must select at least one user group before you can exclude users.
   2. Configure the Endpoint Channels you want to allow or block access to.

      Each endpoint channel is independent and can be configured separately. Enable the Include toggle for each channel you want the policy rule to cover. You can configure each channel to apply to any peripheral added to Enterprise DLP or to specific peripheral devices or peripheral groups.

      • USB Removable Media
        Enable Include to apply the policy rule to USB peripheral devices.
        • Any USB (default)—Rule applies to all USB peripherals added to Enterprise DLP.
        • Select USBs
          • Include—Rule applies only to specific USB peripheral groups.
          • Exclude—Rule applies to all USB peripheral devices except for peripheral devices associated with the selected groups.
      • Printers
        Enable Include to apply the policy rule to printer peripheral devices.
        • Any Printer (default)—Rule applies to all printer peripherals added to Enterprise DLP.
        • Select Printers
          • Include—Rule applies only to specific printer peripheral groups.
          • Exclude—Rule applies to all printer peripheral devices except for peripheral devices associated with the selected groups.
      • Network Shares
        Enable Include to apply the policy rule to network share peripheral devices.
        • Any Share (default)—Rule applies to all network share peripherals added to Enterprise DLP.
        • Select Shares
          • Include—Rule applies only to specific network share peripheral groups.
          • Exclude—Rule applies to all network share peripheral devices except for peripheral devices associated with the selected groups.
   3. Click Next to continue.
5. Configure the Response to define the action Enterprise DLP takes when a user accesses a blocked peripheral.

   • Action—Action Enterprise DLP takes if a User accesses a Peripheral device defined in the policy rule Scope.
     • Alert—Enterprise DLP generates a DLP incident but allows the endpoint to access the peripheral.
     • Block—Enterprise DLP generates a DLP incident and blocks the endpoint from accessing the peripheral.
   • Incident Assignee—The administrator the Enterprise DLP incident is assigned to if one is generated against the policy rule.
   • Email Notifications—Add administrators to send email notifications when an incident is generated against the policy rule.
   • Enable End User Notification—Enable end-user notifications to notify users when they have attempted an action that is disallowed by the rule. From the list, select a notification template to associate with the rule.
     The template determines the appearance and message text that is displayed to the user. To define a new notification template to associate with the rule, select + Create a New Template from the list.

   Click Next to continue.
6. Define the Evaluation Priority for the peripheral control policy rule in your Endpoint DLP policy rulebase.

   You can use the Priority Selection to quickly insert the peripheral control policy rule in the appropriate location in your policy rulebase hierarchy.

   Click Next to continue.
7. Review the policy rule Summary to verify it's configured correctly and click Save.
8. Push your Endpoint Policy rule.

   1. Select Endpoint DLP PolicyPush Policies and click Push Policies.
   2. (Optional) Enter a Description for the Endpoint DLP policy push.
   3. Review the Push Policies scope to understand which Endpoint DLP policy rules and peripheral group configuration changes are included in the push.
   4. Click Push.
9. Review your Endpoint DLP Audit and Push Logs.
10. Review your Enterprise DLP Incidents.

    A DLP incident is generated when a user accesses a peripheral device that is blocked by the policy rule.