Mobile DLP attribute properties

The size of email messages to monitor. Only messages of the specified size or higher are monitored. The default size is 10 MB.

Default severity: low.

Available actions: quarantine (default), permit.

Select the regulatory and compliance rules to enforce. These are applied to all selected regions. (If no regions are selected, an error is displayed. Click Select regions to address the issue.)

• Personally Identifiable Information (PII)
• Protected Health Information (PHI)
• Payment Card Industry (PCI DSS)

After selecting a law, click its name to view or edit the specific policies to enforce, then select a sensitivity for each policy.

• Wide is highly sensitive and errs on the restrictive side. To avoid leaking sensitive data, it is more likely to produce a false positive (unintended match) than a false negative (content that is not detected).
• Default balances the number of false positives and false negatives.
• Narrow is the least restrictive. It is more likely to let content through than to produce an unintended match.

Default severity: high.

Available actions: quarantine (default), permit.

One by one, enter the names of the exact files that should be monitored when they’re attached to an email message. Include the filename and extension. Click Add after each entry.

For example, after adding a file named confidential.docx, when a user attaches a file with that name to an email message, the system detects it and takes the configured action.

Default severity: low.

Available actions: quarantine (default), permit

Click Add to specify the types of files that should be monitored when attached to an email message, for example Microsoft Excel files.

Select the type or types of files to monitor. If there are more file types than can appear on the page, enter search criteria to find the file type you want. The system searches in the file type group, description, and file type for the data you enter.

If the file type does not exist, specify exact files of this type using the

Attachment name attribute instead. Default severity: low.

Available actions: quarantine (default), permit.

Click Add to define key phrases or regular expression (regex) patterns that should be monitored. Regex patterns are used to identify alphanumeric strings of a certain format.

On the resulting dialog box, enter the precise phrase (for example “Internal Only”) or regex pattern (for example ~ m/H.?e/) to include.

Select how many phrase matches must be made for the policy to trigger. The default number of matches is 1.

Define whether to search for the phrase or regex pattern in all email fields, or in one or more specific fields. For example, you may want to search only in an attachment, or skip searching in To and CC fields.

Default severity: medium.

Available actions: quarantine (default), permit.

Note:Although you do not define whether to search only for unique strings, the system uses the following defaults:

• Key phrase searches are non-unique. All matches are reported.
• For regular expression searches, only unique matches are reported as triggered values.

Select the dictionaries that define unacceptable use in your organization.

Forcepoint DLP includes dictionaries in several languages. Select the languages to enforce. Only terms in these languages are considered a match. For example, if you select the Adult dictionary in Hebrew, then adult terms in English are not considered an incident.

Note that false positives (unintended matches) are more likely to occur when you select multiple languages. For this reason, exercise caution when selecting the languages to enforce.

You cannot add or delete terms from predefined dictionaries, but you can exclude terms from detection, if needed. Do this on the Main > Content Classifiers > Patterns & Phrases page. Select the dictionary to edit, then enter the phrases to exclude.

By default, the policy is triggered by a single match from the dictionary or dictionaries you select.

Default severity: medium.

Available actions: quarantine (default), permit.

Select this attribute to prevent pornographic images from entering your organization. Pornographic images pose a legal liability to organizations in many countries.

The system judges images based on the amount of flesh tone they contain.

Default severity: low.

Available actions: quarantine (default), permit.