Forcepoint Data Discovery options
Enter the following information in the Discovery tab:
Steps
- In the Network Discovery section, select Run remediation script when you want the system to run a remediation script for network discovery incidents. Select a script from the associated drop-down list. See Remediation scripts sections.
- In the Endpoint Discovery section, if file labeling is enabled for deployment, it can be selected from the Labeling system drop-down list. Specify up to two Boldon James Classifier labels
and up to one Microsoft Information Protection label to apply to the files.
- If labels are removed from the labeling system, an alert is shown under the removed labels. Select a new label from the drop-down list or clear the check box.
-
If the “No labels were found” message is displayed, import labels as described in Configuring file labeling.
-
Once a label is added, the action plan displays the following information for each label:
- Labeling system
- Selected label
-
Label properties (for example, “Marking” or “Protection” for Microsoft Information Protection labels)
Note: Make sure that only one labeling system is selected for an action plan. Forcepoint DLP supports use of only one labeling system at a time: Either Microsoft Information Protection or Boldon James, but not both.
-
Select Run endpoint remediation script when you want the system to run an endpoint remediation script for endpoint discovery incidents. Select a script from the associated
drop-down list.
Remediation scripts can be added on the Main > Policy Management > Resources > Remediation Scripts page. Select New > Endpoint Script.
-
Under Cloud Discovery, select the Cloud service supported action from the drop- down list:
- Select Permit to allow the transaction.
- Select Safe copy to keep a copy of the file in the cloud archive that is accessible only to administrators.
- Select Quarantine to save the file in a quarantine folder defined in the CASB portal.
- Select Quarantine with note to quarantine the file and leave a message in place of the original file.
- Select Unshare external to remove sharing permissions for any external address.
- Select Unshare all to remove all sharing permissions from the file.
- Click OK to save the changes.