Forcepoint Data Security Cloud | App Security Administrative Guide

Draft | 2026-03-18

Home
Protect
The Protect section is the primary area for adding and managing your applications you wish to protect.
Application Controls
Objects
The Common Objects page is where you can define some of the objects that will be used on the policies page for controlling and performing actions in protected applications.
Configure DLP
DLP is a data loss prevention capability that allows for pattern matching (via regular expressions and keywords) against data as it is either being downloaded, uploaded, or scanned via API at rest.
Predefined DLP patterns
Predefined DLP patterns are those data patterns which are already available in Forcepoint Data Security Cloud | App Security and can be used while configuring policies.

Introduction
Forcepoint Data Security Cloud | App Security provide data security and access management for SaaS applications, ensuring safe and compliant cloud usage. Security teams rely on CASB to perform the following types of functions:
Product updates
Explore the details of newly introduced and updated features here, along with an overview of resolved and known issues.
Getting started
This page helps the admins in setting up and configuring the Forcepoint Data Security Cloud | App Security for the first time and also explains the layout of Forcepoint Data Security Cloud | App Security.
User management
This section explains how administrators manage users, roles, and access permissions.
Home
The Home page provides a visually intuitive, data-driven dashboard that consolidates critical SaaS data discovery metrics, including Summary and Activity Log, along with quick access to key product updates.
Analyze
The Analyze section contains all of your log reports and alerts for visibility into user's activity and suspicious behavior.
Protect
The Protect section is the primary area for adding and managing your applications you wish to protect.
- Add Applications
- Configure applications
  Forcepoint Data Security Cloud | App Security supports various cloud applications so that Admins can monitor data which is in transit, in motion and at rest.
- Application Controls
  - Admin Portal and Global Login Policies
    Forcepoint Data Security Cloud | SSE allows you to control login policies across all apps integrated with Forcepoint Data Security Cloud | SSE as well as access to the admin portal.
  - Objects
    The Common Objects page is where you can define some of the objects that will be used on the policies page for controlling and performing actions in protected applications.
    - Configuring managed device identification
      Forcepoint Data Security Cloud | SSE provides three methods to distinguish between managed and unmanaged devices. This allows for greater restrictions to be applied to users using unmanaged devices.
    - Configuring custom notification files
      The Custom Notification Files are used when configuring a cloud policy to quarantine files when matching based on a condition. This file will replace the original file that is quarantined.
    - Configure DLP
      DLP is a data loss prevention capability that allows for pattern matching (via regular expressions and keywords) against data as it is either being downloaded, uploaded, or scanned via API at rest.
      - Predefined DLP patterns
        Predefined DLP patterns are those data patterns which are already available in Forcepoint Data Security Cloud | App Security and can be used while configuring policies.
        
        Understanding Predefined File type based DLP patterns
        Once predefined file type based DLP patterns are enabled on your tenant, the DLP Objects page displays three predefined DLP patterns for standard file types which can be used while configuring inline (ZTNA and CASB), SWG content and API policies to detect or block content based on file types.
        
        Importing predefined DLP patterns
        Forcepoint Data Security Cloud | App Security contains a large number of predefined DLP patterns based on commonly used objects including matching patterns for Credit Cards, sensitive keywords, U.S. Social Security Numbers, and more.
      - Creating simple data pattern
        Simple patterns allow you to set specific keyword triggers, create regular expressions, or use special keywords to match custom properties.
      - Creating advanced data pattern
        Advanced DLP Pattern Objects allow you to form more complicated patterns that use several primitives combined into expressions using boolean logic, including weighted counts of the number of matches found for specified DLP patterns.
      - Creating exact match data pattern
        Allows you to upload a tokenized csv file to scan through your data-at-rest looking for exact matches based on the data in the uploaded file. You can create an Exact Match pattern in a similar way to creating a Simple or Advanced pattern.
      - Creating file fingerprinting data pattern
        The File Fingerprinting type allows you to create a fingerprint based on a doc or a number of docs to perform a percentage-based match.
      - Creating file mime data pattern
        File Mime Type allows you to create a pattern looking at the mime type (the format of the file itself) rather than based on the content inside of the file.
      - Creating file size data pattern
        Admins can also choose to control files based on their size. This will allow admins to ensure that users are not downloading large files or preventing large files from being uploaded to their sanctioned cloud storage application.
      - Creating file metadata data pattern
        The File Metadata data pattern type allows you to specify the exact inherent metadata and value you wish to match on.
      - Configuring FSM/FONE DS controlled policies for CASB and SWG channels
        Forcepoint Data Security Cloud | App Security provides a capability to enforce DLP policy and associated actions setup in the Forcepoint Security Manager (FSM) or Forcepoint Data Security Cloud | DLP for CASB and SWG channels in Forcepoint Data Security Cloud | App Security.
      - Configuring Advanced Threat Protection
        Forcepoint Data Security Cloud | App Security provides Advanced Threat Protection (ATP) via partnerships with an antimalware provider.
      - Understanding Field Programmable SASE Logic
        Field Programmable SASE Logic (FPSL) provides unprecedented support for inline controls over user action and activities within cloud services.
    - Adding custom locations
      The Custom Locations page located under Protect > Objects is where you can define custom locations that can be used on the policies page for controlling and performing actions in protected applications.
    - UEBA Observables
      Admins can now identify and control users performing bulk activities, such as modifying, downloading, deleting and sharingchanging of files, for data at rest.
  - Policies
    This is where you will manage all of your protected applications. This page will walk you through the basics of the Protect > Policies and act as a landing page to link you to the relevant pages to walk you through configuring your application policies.
  - Setting up API access to managed cloud applications
    To enable offline scanning of cloud applications, configure an API connection to one or more of your selected cloud applications. Then configure data at rest and API-based enforcement policy actions.
  - Configuring Field Encryption via Inline or API
    At times you may want to encrypt certain objects or attributes in an application while users input data inline or when passing an API call to an external endpoint.
  - Dynamic SaaS Groups
    Customers can configure groups of SaaS apps from our cloud app repository and export that information to ingest that information into third party SWG's for automated blocking. Currently, this feature supports Bluecoat (Broadcom) and PANW.
- Configuring notifications
  Admins can create custom notification objects that can be applied to policies and reports. This will determine which admins or users are notified when a policy is violated and what the custom message says.
- Setup traffic steering
  Forcepoint Data Security Cloud | App Security supports SmartEdge Agent and Cloud SWG traffic steering methods. This chapter describes steps to deploy each of those so that traffic can be forwarded to Forcepoint Data Security Cloud | App Security.
- Configuring SWG policies
  You can configure SWG Connection Policy, Cloud SWG Authentication Policy and SWG Content Policy to manage traffic through Cloud SWG and SmartEdge agent.
- Configuring Advanced Threat Protection
  Forcepoint Data Security Cloud | App Security provides Advanced Threat Protection (ATP) via partnerships with an antimalware provider.
- Integration
Settings
The Settings section contains the majority of your setting configurations to be used in policies or integrations.
Appendices

Predefined DLP patterns

Predefined DLP patterns are those data patterns which are already available in Forcepoint Data Security Cloud | App Security and can be used while configuring policies.

Understanding Predefined File type based DLP patterns
Once predefined file type based DLP patterns are enabled on your tenant, the DLP Objects page displays three predefined DLP patterns for standard file types which can be used while configuring inline (ZTNA and CASB), SWG content and API policies to detect or block content based on file types.
Importing predefined DLP patterns
Forcepoint Data Security Cloud | App Security contains a large number of predefined DLP patterns based on commonly used objects including matching patterns for Credit Cards, sensitive keywords, U.S. Social Security Numbers, and more.

Copyright © 2026 Forcepoint LLC
DRAFT | 2026-03-18