Create Custom Profile

The Create Profile editor can be used to create custom profiles. If the administrator wants, then they can select the Inherit default profile option provided with each widget to apply the values from the default profile.

Profile Details

Profile name: Each profile is stored using the provided name.

Description: Brief description of the profile.

Applies to:

Use this section to define the scope to exclude or include in the profile. The scope defines the endpoints or organizational units which should be subjected to this profile.

The selection list is limited to 100 entries. Use search to find additional endpoints or OUs.

In the Search option, enter the resource name, then click to add to the list for either inclusion or exclusion. You can also use the Add all or Remove all options to remove or add multiple entries. Similarly, you can use the to remove entries that were added earlier for either exclusion or inclusion.

Also, from the Select OS: option select the operating system running on the endpoint machine.

When including an OU or endpoint in the "Include" list all other OUs and endpoints are excluded. The "Exclude" list overrides the "Include" list. It is used, for example, to select an OU but exclude specific endpoints that belong to this OU.

Note: it is not possible to select the same OU or endpoint to both lists. If you include endpoints and exclude an OU they belong to, these endpoints will not be included since the exclusion of them as part of the excluded OU, overrides the inclusion.

General

Administrators can control all of the following from the General widget:
  • Displayed customer name: Set the customer name that is displayed on the Forcepoint Agent console.
  • Default domain for local users: The endpoint uses the down-level logon name of the end user when determining which policy to enforce on web requests. When the end-user logs in as a local user (common in macOS), there is no domain part in the down-level logon that the endpoint uses. Select one of the following options to set the domain part:
    • Host Name: The host name of the endpoint is used, for example <hostname>\local_user. This is the default.
    • Custom domain name: Both of the following fields are required:
      • UPN domain name: The endpoint reports the local user as local_user@<UPN domain name>, for example local_user@domain_name.com.
      • NTLM domain name: The endpoint reports the local user as <NTLM domain name>\local_user, for example domain_name\local_user.
      When a custom domain name is set, local users are reported as domain users.

    Note: The Custom domain name option is supported only on macOS agent version 30.9.208 and later.
  • Endpoint Connectivity to Forcepoint Data Security Cloud: Allows manual configuration of proxy settings for proxies that require authentication.

Customer Logo (Applies to Default Profile Only)

You can add a custom company logo for Forcepoint Data Security Cloud | DLP agent installs using this widget.

Uploading the Logo

  1. Click Select logo to select and upload the image file.

  2. After the file explorer opens, browse and select the image you want to upload. Only PNG images of dimensions of 300 x 50 pixels and a maximum size of 50 KB are supported.

Only one logo is allowed per tenant. Uploading a new logo replaces the previous one.

The uploaded logo will appear both in the agent coaching dialog and in alert email notifications.

Updating or Removing Previously Uploaded Logo
  1. To update or remove the previously uploaded logo, click the Change logo button and upload the new logo.

Over the air updates

Displays which agent software versions are pushed to the endpoints. Values are inherited from default profile settings. Over the air updates can be enabled or disabled from the Default profile. Also, administrators can either opt for automatic updates or select specific agent versions to update from the Default profile. If Update to a specific version is selected, then the drop-down can be used to select the exact agent version of the Windows or macOS agent to update to.

Administrators can choose to enable the option Inherit default profile if they want to inherit the settings from the default profile.

Data Protection

The Data Protection widget enables users that have Data Protection license to disable or enable it. Administrators can choose to enable the option Inherit default profile if they want to inherit the settings from the default profile.

Managed by: The data protection license applies both to On-Prem and Forcepoint Data Security Cloud DLP licenses. Those users who have only one of the licenses will see only the respective option (On-Premise or Cloud) under Managed by field. Users that have both the licenses will be able to select whether the profile is managed by On-Premise or Cloud.
Note: DLP mode switching is supported on both macOS and Windows endpoint systems. In Windows systems, the switching requires a system reboot before the new mode takes effect.
In the On-Premise option, for Hybrid DLP deployments, you must establish connectivity to the Forcepoint Security Manager (FSM) by uploading the following files obtained from the DLP manager:
  • FSM certificate - ca.cer certificate used for communication with FSM.
  • Configuration file - localconfig.xml file.
On the endpoint, the main window of the Forcepoint Agent console is product agnostic. It displays only the details that are common to all products:
  • Connection: The customer name, the connection status, and the Forcepoint cloud region that the agent connects to.
  • Agent Settings: The date and time the agent settings were last updated, the profile applied to the endpoint, and the Status list of the products that are enabled on the endpoint. When Data Protection is deployed in Hybrid mode, the entry is displayed as Data Protection (Hybrid).
  • General Information: The user name and the tenant ID.

To view the details for a specific product, click the product in the Status list. Click Data Protection to open the Data Protection dialog, which displays the following:
  • DLP Policy Engine Version: The version of the DLP policy engine installed on the endpoint.
  • Policy version: The version of the DLP policy that the endpoint currently enforces.
  • Policy updated: The date and time the policy was last updated.
  • Profile version: The version of the profile applied to the endpoint.
  • Profile updated: The date and time the profile was last updated.
  • Connection status: Whether the endpoint is connected to the server that manages Data Protection.
  • Forcepoint Agent server: The address of the Forcepoint Agent server that the endpoint is connected to. This is displayed when Data Protection is managed by On-Premise.
  • Fingerprint version: The version of the fingerprint repository on the endpoint.
  • Discovery status: The current state of endpoint discovery, for example Running or Idle.
  • Last scan ended: The date and time the last discovery scan finished.
  • Files scanned: The number of files scanned by discovery.
  • Next scan time: The date and time the next scheduled discovery scan starts.

This Windows agent does not support inline proxy or browser extension. It uses a different web inspection method called application and SSL hooking.

Administrators can choose to enable the option Inherit default profile if they want to inherit the settings from the default profile.

In the Default Language section, administrators can configure a default language for both custom and default profiles, displaying the end user notifications. The following languages are supported:
  • English
  • Dutch
  • French
  • German
  • Italian
  • Japanese
  • Korean
  • Portuguese
  • Russian
  • Simplified Chinese
  • Traditional Chinese
  • Spanish

Products

Lists the features available and the license requirements.

In this section, administrators can enable/disable the following products on the endpoint, if they have respective licenses:
  • Device Control
  • User Activity Monitoring
  • Web
    Note: An endpoint reboot may be required for the product disablement/enablement to take effect.

If the customer does not have a license for one of the above products, the respective enable/disable toggle will be disabled.

Administrators can choose to enable the option Inherit default profile if they want to inherit the settings from the default profile.

Device control on the endpoint

Device control restricts end user access to removable storage devices on the endpoint. When this product is enabled, the endpoint enforces the device control policy that is defined in the Forcepoint Data Security Cloud DLP portal, and applies one of the following access permissions to each removable storage device that is connected to the endpoint:
  • Allow (Trust & Monitor) - The end user can read, write, and modify files on the device.
  • Block (Zero Trust) - The end user cannot open, read, or save files to the device.
  • Read only (Limited Trust) - The end user can read files from the device, but cannot save, modify, or copy files to the device.
These are configured from the Device control tab of the Policy page in the portal. For more information, refer Device control in the Forcepoint Data Security Cloud DLP documentation.
When Device Control is enabled for the profile, the Forcepoint DLP Endpoint console on the endpoint displays a Devices tab in addition to the About tab. The Devices tab displays the following:
  • Connected devices: Lists each removable storage device that is currently connected to the endpoint, with the device name, the device serial number, and the access permission that the endpoint currently applies to the device.
  • Device bypass: Allows the end user to temporarily suspend device control enforcement on the endpoint, using a bypass code obtained from the administrator.

    A bypass code can be generated by the administrator for that specific endpoint, and is valid for a limited time. When the end user clicks Device bypass on the Devices tab, the endpoint prompts for the code:

    Refer to Bypass code for removable storage devices for the steps to generate the bypass code. When a valid code is entered, device control rules are bypassed on that endpoint for 24 hours from the time the code is activated. Device activity continues to be monitored while the bypass is active.

    When a bypass is started, an alert is reported to the portal with the User Bypass Initiated operation, and the time that the bypass started is recorded on the alert as the Endpoint bypass start time.

If the rule that is matched is configured to notify the end user, the endpoint displays a notification when the device is connected or when an operation is not permitted. For example, when a device is assigned the Read only permission, the endpoint notifies the end user that file changes are not authorized.

Device control activity that is detected on the endpoint is reported to the portal, and can be reviewed from the Alerts tab of the Investigation page, where the alerts are listed with the Device control category and the Removable media channel.

Application Monitoring

Administrators can select applications whose traffic should be monitored for Windows endpoints.

In the Search option, enter the application name, then click the Add <app> to list to add applications to the list.
  • For Windows, enter an executable name such as chrome.exe.
  • Do not use wildcards.

Select the application name from the list and click Remove from list to remove the application.

Administrators can choose to enable the option Inherit default profile if they want to inherit the settings from the default profile.

Application Bypass

Administrators can exclude specific applications from DLP monitoring on Windows endpoints.

In the Search option, enter the application name, then click Add <app> to list to add applications to the list.

  • For Windows, enter an executable name such as chrome.exe.
  • Do not use wildcards.

Select the application name from the list and click Remove from list to remove the application.

Administrators can choose to enable the option Inherit default profile if they want to inherit the settings from the default profile.

Scanning Inspection Bypass

Administrators can add domains on which submitted content should not be scanned. This applies to the Windows Forcepoint agent. The Windows Forcepoint agent does not perform SSL decryption, but this setting can be used to limit scanning on the specified domains.

This does not change how the configuration is used by older Windows agents or Mac agent installs.

Use the toggle button to enable or disable the SSL Inspection Bypass.

Enter the domain name in the search option and click the search icon and then click Add <domain> to list or you can drag and drop or browse a .txt file with comma-separated domains to add domains to the list.

Administrators can choose to enable the option Inherit default profile if they want to inherit the settings from the default profile.