Standard Forcepoint DLP options

On the Data Loss Prevention tab, complete the fields as follows. See Possible actions for an action plan section for a description of each possible action.

Under Network Channels:

Action	Description
Email	Select an action to take when a breach is discovered on network email channels.
FTP	Select an action to take when a breach is discovered over FTP.
HTTP/HTTPS	Select an action to take when a breach is discovered over HTTP or secure HTTP.
Chat	Select an action to take when a breach is discovered over chat.
Plain text	Select an action to take when a breach is discovered via plain text.

Under Endpoint Channels:

Action	Description
Email	Select an action to take when a breach is discovered on endpoint email. You cannot release endpoint email; therefore, you can only block messages, not quarantine them.
Application control	Select an action to take when a breach is discovered on an endpoint application such as Word.
Removable media	Select an action to take when a breach is discovered on an endpoint device such as a thumb drive.
HTTP/HTTPS	Select an action to take when a breach is discovered on an endpoint device over HTTP or secure HTTP.
LAN	Select an action to take when a breach is discovered on an endpoint LAN, such as when a user copies sensitive data from a workstation to a laptop.
Printing	Select an action to take when a breach is discovered on a local or network printer that is connected to an endpoint.

As action plans for Network Channels, you can choose one of the following from the drop down:

Select Permit to allow user action.
Select Drop Attachments to drop email attachments that are in breach of policy and quarantine email messages.
Select Quarantine to save the file in a quarantine folder.
Select Encrypt to encrypt the affected email message.
Select Custom Action 1 to Custom Action 5 to perform an Email Security action when a DLP breach is detected. This can be applied only to email sent as part of Forcepoint Data Security for Cloud Email product's solution.
Note: Custom actions appear only if you have enabled the Enable custom actions check box in Data Protection Service in Settings > General > Services.

As action plans for Endpoint channels, you can choose one of the following from the drop down:

Select Permit to allow user action.
Select Permit (Acknowledge) to allow the user action and display a pop-up notification to the user on the Endpoint. The notification prompts the user to acknowledge that their sensitive data usage is being audited.
Note: This feature will be supported in an upcoming Forcepoint F1E release.
Select Block to prevent the user action.
Select Confirm to allow user action.
For removable media, you can select the Encrypt with profile key or Encrypt with user password options.

Under MCP Gateway

Action	Description
User/AI Agent request	Select an action to take when a breach is discovered in a request that a user or AI agent sends through the MCP Gateway to an MCP connector.
MCP connector response	Select an action to take when a breach is discovered in a response that an MCP connector returns through the MCP Gateway.

As action plans for MCP Gateway, you can choose one of the following from the drop down:

Select Permit to allow the transaction.
Select Block to prevent the transaction.

Under Cloud Channels, there are two channels: DLP Cloud Proxy and DLP Cloud API.

For DLP Cloud Proxy, select from the drop-down list an action to take when an incident involves files uploaded, attached, or downloaded from a cloud application.

Select Permit to allow files to be uploaded, attached, or downloaded.
Select Block to prevent the user action.

Note: When Block is applied, some desktop cloud applications might perform multiple retries to sync with the cloud service, and potentially malfunction. If this happens, multiple incidents might be received by the DLP system.

For DLP Cloud API (used by AI Security and CASB systems), select from the drop-down list an action to take when an incident involves files uploaded to, downloaded from, shared with others, AI Prompt and AI Response.

Action	What happens
Permit	Allows files to be uploaded, synchronized, downloaded, or shared.
Safe copy	Keeps a copy of the file in a cloud archive that only administrators can access.
Quarantine with a note	Quarantine the file and leave a message in place of the original file. This action is not supported for AI Security operations. If you select this option for these operations, the Safe copy action is performed instead. Stay tuned for updates on its availability in Understanding Remediation Settings.
Delete AI content	Deletes the submitted prompt or the AI-generated content returned to the user. This action is not supported. Stay tuned for updates on its availability in Understanding Remediation Settings.
Unshare external and public file-sharing	Removes sharing permissions for any external address.
Unshare all	Removes all sharing permissions from the file.

Important:

Before you select an action for AI Security, see Understanding Remediation Settings. It explains how each remediation works and how to configure the safe copy path, which you must set up before the Safe copy action can be used. Not all actions are supported for every AI application. If an action is not supported for an application, the activity is audited and an incident is created.
For more information about Forcepoint AI Security solution conditions, see Integrating Forcepoint AI Security with Forcepoint DLP On-Prem.

By default, all incidents are audited. Clear the Audit incident check box if you do not want to audit incidents.
Warning: If you turn off this option, incidents are not logged, so you will not know when a policy is breached.

When Audit incident is selected, select one or more of the following additional options:
- Select Include forensics to include information about the transaction that resulted in the incident, such as the contents of an email body: From:, To:, Cc: fields; attachments, URL category, hostname, file name, and more.
  Forensics display in the incident report.
- Select Run remediation script to have the system run a script when an incident is discovered, then select the script to use from the drop-down list. See Remediation scripts section for more information.
- Select Run endpoint remediation script to have the system run an endpoint remediation script when an incident is discovered, then select the script to use from the drop-down list.
- Select Send syslog message to notify an outside syslog server or ticketing system of the incident.
- Select Send email notifications to send an email message to a designated recipient when a policy is breached.
  - Select the message or messages to send.
  - Click a link to view or modify standard messages.
  - Click New to create a custom message.
  See Notifications and Adding a new message sections for details.
Tip: There is a benefit to using the same template for each action plan. The system gathers notifications for individual users according to templates and combines them into a single notification. Therefore, if an incident contains 10 different rules, each with a different action plan but the same template, the user receives a single notification with the details of all the breaches.

To configure discovery options, continue to the next section. Otherwise, click OK to save the changes.