When to use the protector

The protector works in tandem with a Forcepoint DLP server.

• The Forcepoint DLP server provides advanced analysis capabilities, while the protector intercepts network traffic and either monitors or blocks it, depending on the channel.
• The protector supports analysis of SMTP, HTTP/S, FTP, and plain text. It can monitor or block email traffic, but only monitor web traffic. Blocking web traffic requires integration with a third-party proxy that supports ICAP.

The protector fits into the network with minimal configuration. It requires no network infrastructure changes.

The protector is the best choice for monitoring SMTP traffic. Just connect the protector to a SPAN or mirror port that reflects the SMTP traffic.

For email blocking capabilities, use the protector’s explicit MTA mode.

To monitor HTTP traffic, either use the protector or integrate Forcepoint DLP with another web proxy.

To monitor FTP or plain text, use the protector. Note that the protector cannot block traffic on these channels. Optionally, integrate with another web proxy that buffers FTP and supports ICAP.