Possible actions for an action plan

Quarantine email messages containing sensitive data. Network email can be encrypted before it’s released. Select Encrypt on release to enable this feature (this feature is not supported for Forcepoint Email Security Cloud).

Note:When a mobile email message is released from quarantine, it is sent to the mobile device the next time the device is connected to the network.

• Drops email attachments that are in breach of policy.
  • Applies to messages detected by the Forcepoint Email Security module (except for Forcepoint Email Security Cloud).
  • Applies to rules that monitor data in “each part separately.”
• Quarantines email messages that:
  • Have a body breach, but not an attachment breach.
  • Have breaches in both the message body and attachment.
  • Are detected by agents other than Forcepoint Email Security, such as the protector.
  • Are detected when rules are monitoring data in “the transaction as a whole.”
  • Fail to drop attachments when indicated.

Note:If a violation is found in a uuencoded attachment, the attachment is treated as email body and blocked rather than dropped. This is because additional content is placed between the attachments, including the attachment name. (UNIX-to- UNIX encoding [uuencoding] is a utility that most email applications use for encoding and decoding files.)

Select Encrypt on release if you want quarantined messages to be encrypted before they’re released. If an attachment has been dropped, this option reattaches it and encrypts both the body and attachment before releasing the message.

To release an incident, an administrator selects Remediate > Release

on the incident details toolbar.

Encrypt the affected email message.

With Forcepoint DLP agents and Forcepoint Email Security, this option applies to all email directions.

For cloud infrastructure deployments such as Microsoft Azure, this option applies only to outbound email. (Inbound and Internal email is permitted, and an alert is sent to the Forcepoint Email Security administrator.)

Windows removable media only. Encrypts sensitive data for users who will be decrypting files from other machines (those without the endpoint agent installed). Passwords are set by endpoint users. Files are decrypted using a special utility.

Note that if the user has not yet configured a password when the first breach is detected, the system prompts the user for a password and then blocks the operation. The encryption action is not performed until subsequent transactions.

This option is not supported on Mac or Linux endpoints. Removable media transactions are permitted on Mac and Linux when this option is selected.

Display a confirmation message, such as the following when a security threat is detected:

Forcepoint DLP Endpoint has detected that you’re trying to copy sensitive data to a removable drive, which appears to be in violation of corporate policy. Do you want to continue?

Users can continue if they enter a business reason for the operation, or

they can cancel. If they cancel or wait too long, the default action is taken.

To configure the default action, go to the Settings > General > Endpoint page and select Block or Permit on the General tab.

Run a script that performs specific actions when an incident is detected.

Remediation scripts can be run when network discovery, endpoint discovery, or DLP incidents are detected.

See Remediation scripts section.

Add classification tags to files that trigger a discovery incident, following the guidelines established on the Settings > General > Services > Classification Tagging page.

Endpoint discovery only.

Requires a supported, third-party classification tagging system.