Forcepoint ONE SSE Deployment Guide Document Subtitle

Home
Configure DLP
DLP is a data loss prevention capability that allows for pattern matching (via regular expressions and keywords) against data as it is either being downloaded, uploaded, or scanned via API at rest.
Configuring Advanced Threat Protection
Forcepoint ONE SSE provides Advanced Threat Protection (ATP) via partnerships with Crowdstrike and Bitdefender.
Understanding supported file types
Each of the OEM vendors you partner with may support different file types for scanning. This is also contingent on the Forcepoint ONE SSE mode the file is passing through (SWG, Reverse proxy, API, etc).
Viewing Forcepoint ONE SSE supported file MIME types

Verify access and perform initial configuration
Describes about initial account configurations, such as creating and assigning administrator accounts and roles, and configuring portal access and timeout policies in Forcepoint ONE Security Service Edge.
Integrate identity
You can configure user identity settings and synchronize user information from your directory in order to assign policies to users or groups.
Configure common components
Describes how to configure common components such as login policies, various notifications, custom notification files and so on.
Setup traffic steering
Forcepoint ONE SSE supports SmartEdge Agent and Cloud SWG traffic steering methods. This chapter describes steps to deploy each of those so that traffic can be forwarded to Forcepoint ONE SSE.
Configure DLP
DLP is a data loss prevention capability that allows for pattern matching (via regular expressions and keywords) against data as it is either being downloaded, uploaded, or scanned via API at rest.
- Predefined DLP patterns
  Predefined DLP patterns are those data patterns which are already available in Forcepoint ONE SSE and can be used while configuring policies.
- Creating simple data pattern
  Simple patterns allow you to set specific keyword triggers, create regular expressions, or use special keywords to match custom properties.
- Creating advanced data pattern
  Advanced DLP Pattern Objects allow you to form more complicated patterns that use several primitives combined into expressions using boolean logic, including weighted counts of the number of matches found for specified DLP patterns.
- Creating exact match data pattern
  Allows you to upload a tokenized csv file to scan through your data-at-rest looking for exact matches based on the data in the uploaded file. You can create an Exact Match pattern in a similar way to creating a Simple or Advanced pattern.
- Creating file fingerprinting data pattern
  The File Fingerprinting type allows you to create a fingerprint based on a doc or a number of docs to perform a percentage-based match.
- Creating file mime data pattern
  File Mime Type allows you to create a pattern looking at the mime type (the format of the file itself) rather than based on the content inside of the file.
- Creating file size data pattern
  Admins can also choose to control files based on their size. This will allow admins to ensure that users are not downloading large files or preventing large files from being uploaded to their sanctioned cloud storage application.
- Creating file metadata data pattern
  The File Metadata data pattern type allows you to specify the exact inherent metadata and value you wish to match on.
- Configuring FSM controlled policies for CASB and SWG channels
  Forcepoint ONE SSE provides a capability to enforce DLP policy and associated actions setup in the Forcepoint Security Manager (FSM) for CASB and SWG channels in Forcepoint ONE SSE.
- Configuring Advanced Threat Protection
  Forcepoint ONE SSE provides Advanced Threat Protection (ATP) via partnerships with Crowdstrike and Bitdefender.
  - Setting ATP scanning policy
    You can protect your cloud application from malware by setting up ATP scanning using any of the ATP options that you have purchased. Setting up ATP scanning for your cloud application, is same as configuring any other data pattern with minor difference.
  - Understanding supported file types
    Each of the OEM vendors you partner with may support different file types for scanning. This is also contingent on the Forcepoint ONE SSE mode the file is passing through (SWG, Reverse proxy, API, etc).
    - Viewing Forcepoint ONE SSE supported file MIME types
      - Viewing supported file MIME types for both inline and API scanning
        Lists supported file MIME Types for both access and API scanning.
      - Viewing additional file MIME types supported specifically for API scanning
        Lists additional file MIME Types supported specifically for API scanning.
- Understanding Field Programmable SASE Logic
  Field Programmable SASE Logic (FPSL) provides unprecedented support for inline controls over user action and activities within cloud services.
Configure Zero Trust Network Access
Forcepoint ONE SSE's Agentless and Agent-based Zero Trust Network Access (ZTNA) provides an alternative to VPNs allowing admins to provide inline protection to internal apps without the need for VPN service to be running on the user's local machine.
Protect cloud applications
This chapter describes how to setup various cloud applications in Forcepoint ONE SSE so that Admins can monitor the data at rest and data in motion.
Configure policies
Describes how to configure policies for your application in Forcepoint ONE SSE portal so that you can monitor the data at rest and data in motion.
Monitor and analyze traffic
You can perform steps to monitor and analyze the traffic. Forcepoint ONE SSE Log Export REST API allows customers to query and pull cloud and access Logs. Alternatively, customers with Splunk or QRadar can instead utilize the Forcepoint ONE SSE Splunk app or the Forcepoint ONE SSE QRadar App for easy integration with the Forcepoint ONE SSE REST API to extract Forcepoint ONE SSE logs.
Configure applications
Forcepoint ONE SSE supports various cloud applications so that Admins can monitor data which is in transit, in motion and at rest.

Viewing Forcepoint ONE SSE supported file MIME types

Forcepoint ONE SSE supports inline DLP scanning, and API (Cloud) scanning.

Viewing supported file MIME types for both inline and API scanning
Lists supported file MIME Types for both access and API scanning.
Viewing additional file MIME types supported specifically for API scanning
Lists additional file MIME Types supported specifically for API scanning.

Copyright © 2024 Forcepoint LLC