Administrators monitor user activity on endpoint devices remotely through the Forcepoint Neo management portal. Analysts use the management portal to view investigation details.

User activity monitoring solution designed to alert organizations of risky user behavior so they can protect data and reduce risks.

Access Forcepoint help and support services for assistance and troubleshooting.

Before installing Neo, verify the system requirements for your endpoints.

Before installing the Neo endpoint and setting up your Dynamic User Protection service, verify that the antivirus software allows Neo and that Neo can communicate with Amazon Web Services.

These instructions detail the steps for downloading Neo agent from the Neo cloud portal.

Install Neo agent on Windows endpoints. Forcepoint Neo is a cloud-managed endpoint that runs on both Windows and Mac.

Uninstall Neo agent on Windows endpoints. Forcepoint Neo is a cloud-managed endpoint that runs on both Windows and Mac.

Install Neo agent on Windows endpoints. Forcepoint Neo is a cloud-managed endpoint that runs on both Windows and Mac.

Install Neo agent on macOS endpoints to get started analyzing your users with Forcepoint Neo.

Install Neo agent on macOS endpoint using jamf.

You can update your managed endpoints to the latest version of Neo either manually, automatically, or on demand. Each update method requires a specific version of Neo.

Manual updates for Neo allows your administrators to update specific managed endpoints on your schedule.

The Over the air updates settings on the Settings tab on the management portal allows administrators to choose whether to update to the latest Neo version or to update to a Neo specific version.

Neo offers the functionality of the classic Forcepoint F1E agents (Proxy Connect Endpoint and Direct Connect Endpoint) in one package starting in Neo 21.03 (Windows 10) and Neo 21.06 (macOS Big Sur 11). Neo can intelligently switch between the proxy connect and direct modes depending on network conditions and performance.

If you already deploy classic Proxy Connect Endpoint and Direct Connect Endpoint agents in your organization, you can migrate to Neo easily.

Download Neo agent from the Forcepoint Cloud Security Gateway portal or Neo cloud portal, depending on your Forcepoint licenses.

These instructions detail the steps for installing Neo agent on the endpoints in your organization. Follow these steps only if you are a new user of Forcepoint Neo.

Configure the Neo connection mode in the Cloud Security Gateway portal. There are three options: intelligent auto-switching, proxy connect, and direct connect.

Risk-Adaptive DLP combines the on-premises Forcepoint DLP Endpoint for Forcepoint F1E and the cloud-based Neo endpoint to provide user activity information to both Forcepoint DLP (on-premises) and Forcepoint Dynamic User Protection (cloud).

Risk-Adaptive DLP requires both Forcepoint DLP Endpoint and Neo. You can manually install them on your endpoints, or you can deploy them using a third-party deployment tool, such as GPO or MECM.

Risk-Adaptive DLP must be enabled in Forcepoint Security Manager before user risk scores can be sent to Forcepoint DLP.

After Risk-Adaptive DLP is enabled, Forcepoint DLP policies and action plans can be configured based on Dynamic User Protection severity.

After Risk-Adaptive DLP is enabled, user risk scores display in Forcepoint DLP incident reports for review and analysis.

Complete the following steps to configure Okta as a SAML identity provider for Neo cloud portal SSO authentication. This will ensure visibility and access control of the Neo cloud portal via Okta.

Complete the following steps to configure Azure as a SAML identity provider for Neo cloud portal SSO authentication. This will ensure visibility and access control of the Neo cloud portal via Azure.

When you first sign in, you will be prompted to select an authentication method.

You can change your password at any time when signed in to Dynamic User Protection.

Neo cloud portal supports login via SAML identity providers like Okta and Azure. This helps to improve the Neo cloud portal user access experience and eases the cross-platform login.

Use the Users dashboard to gain a high-level view of user activities in your organization.

Use the Endpoints dashboard to gain a high-level view on the status of Neo endpoints in your organization.

In the Users panel, you can view per user details on risk level, most recent activity, alerts, and also other details.

Alerts tab displays detailed information on alerts recorded in the organization.

Devices investigation provides advanced tool to search, analyze, and obtain the device usage insights based on the correlation of users and endpoints.​

Neo retrieves attributes from Active Directory to report user information to Dynamic User Protection. The following table displays the Active Directory attributes used in Dynamic User Protection. This information displays on the Overview panel.

All of your endpoints display under Devices. When you click on a device from the list or from the Investigation dashboard, the Details panel displays with additional system information and functionality for the selected device.

The Endpoint management dashboard and Details panel display the status of Neo for each endpoint.

Devices can be removed from your organization using the Endpoint management dashboard.

Forcepoint Neo device control is a measure of protection that restricts user access to removable storage devices.

Using the User activity monitoring tab, administrators can customize the IOBs (modify the IoB predefined severity and exclude or include certain users and groups).

Browse users and groups that are available to Neo cloud portal or import them from the file.

Two types of users have access to the Dynamic User Protection management portal: administrators and analysts.

The Forcepoint Neo endpoint settings tab provides options for better management and troubleshooting of the endpoints to administrators. Administrators can now control Forcepoint Neo endpoint operational mode from the Cloud Portal, for advance troubleshooting and compatibility with 3rd party applications.​

The Advanced tab allows the administrators to integrate with Amazon Replication Service and External Identity Providers.

New features and product updates added in this release.

Refer to the Forcepoint Knowledge Base for details of current known issues and former issues that have been resolved.