Forcepoint ONE SSE Administrative Guide Document Subtitle

Home
Protect
Application Controls
Objects
The Common Objects page is where you can define some of the objects that will be used on the policies page for controlling and performing actions in protected applications.
Configure DLP
DLP is a data loss prevention capability that allows for pattern matching (via regular expressions and keywords) against data as it is either being downloaded, uploaded, or scanned via API at rest.
Predefined DLP patterns
Predefined DLP patterns are those data patterns which are already available in Forcepoint ONE SSE and can be used while configuring policies.

Admin Portal
Analyze
Protect
- Add Applications
- Configure applications
  Forcepoint ONE SSE supports various cloud applications so that Admins can monitor data which is in transit, in motion and at rest.
- Application Controls
  - Admin Portal and Global Login Policies
    Forcepoint ONE SSE allows you to control login policies across all apps integrated with Forcepoint ONE SSE as well as access to the admin portal.
  - Objects
    The Common Objects page is where you can define some of the objects that will be used on the policies page for controlling and performing actions in protected applications.
    - Configuring managed device identification
      Forcepoint ONE SSE provides three methods to distinguish between managed and unmanaged devices. This allows for greater restrictions to be applied to users using unmanaged devices.
    - Configuring custom notification files
      The Custom Notification Files are used when configuring a cloud policy to quarantine files when matching based on a condition. This file will replace the original file that is quarantined.
    - Custom URL Categories
      When using the SmartEdge agent or Cloud-SWG to provide controls over sites/applications based on application categories or trustworthiness, admins can create their own group of specific domains to apply policy to.
    - External IdP
      The External IdP card is where you can add any external IdP to be used for authentication within your domain or by individual app or app instances.
    - Configure DLP
      DLP is a data loss prevention capability that allows for pattern matching (via regular expressions and keywords) against data as it is either being downloaded, uploaded, or scanned via API at rest.
      - Predefined DLP patterns
        Predefined DLP patterns are those data patterns which are already available in Forcepoint ONE SSE and can be used while configuring policies.
        
        Understanding Predefined File type based DLP patterns
        Once predefined file type based DLP patterns are enabled on your tenant, the DLP Objects page displays three predefined DLP patterns for standard file types which can be used while configuring inline (ZTNA and CASB), SWG content and API policies to detect or block content based on file types.
        
        Importing predefined DLP patterns
        Forcepoint ONE SSE contains a large number of predefined DLP patterns based on commonly used objects including matching patterns for Credit Cards, sensitive keywords, U.S. Social Security Numbers, and more.
      - Creating simple data pattern
        Simple patterns allow you to set specific keyword triggers, create regular expressions, or use special keywords to match custom properties.
      - Creating advanced data pattern
        Advanced DLP Pattern Objects allow you to form more complicated patterns that use several primitives combined into expressions using boolean logic, including weighted counts of the number of matches found for specified DLP patterns.
      - Creating exact match data pattern
        Allows you to upload a tokenized csv file to scan through your data-at-rest looking for exact matches based on the data in the uploaded file. You can create an Exact Match pattern in a similar way to creating a Simple or Advanced pattern.
      - Creating file fingerprinting data pattern
        The File Fingerprinting type allows you to create a fingerprint based on a doc or a number of docs to perform a percentage-based match.
      - Creating file mime data pattern
        File Mime Type allows you to create a pattern looking at the mime type (the format of the file itself) rather than based on the content inside of the file.
      - Creating file size data pattern
        Admins can also choose to control files based on their size. This will allow admins to ensure that users are not downloading large files or preventing large files from being uploaded to their sanctioned cloud storage application.
      - Creating file metadata data pattern
        The File Metadata data pattern type allows you to specify the exact inherent metadata and value you wish to match on.
      - Configuring FSM/FONE DS controlled policies for CASB and SWG channels
        Forcepoint ONE SSE provides a capability to enforce DLP policy and associated actions setup in the Forcepoint Security Manager (FSM) or Forcepoint ONE Data Security (FONE DS) for CASB and SWG channels in Forcepoint ONE SSE.
      - Configuring Advanced Threat Protection
        Forcepoint ONE SSE provides Advanced Threat Protection (ATP) via partnerships with Crowdstrike and Bitdefender.
      - Understanding Field Programmable SASE Logic
        Field Programmable SASE Logic (FPSL) provides unprecedented support for inline controls over user action and activities within cloud services.
    - Adding custom locations
      The Custom Locations page located under Protect > Objects is where you can define custom locations that can be used on the policies page for controlling and performing actions in protected applications.
    - UEBA Observables
      Admins can now identify and control users performing bulk activities, such as modifying, downloading, deleting and sharingchanging of files, for data at rest.
  - Policies
    This is where you will manage all of your protected applications. This page will walk you through the basics of the Protect > Policies and act as a landing page to link you to the relevant pages to walk you through configuring your application policies.
  - Setting up API access to managed cloud applications
    To enable offline scanning of cloud applications, configure an API connection to one or more of your selected cloud applications. Then configure data at rest and API-based enforcement policy actions.
  - Configuring Field Encryption via Inline or API
    At times you may want to encrypt certain objects or attributes in an application while users input data inline or when passing an API call to an external endpoint.
  - Dynamic SaaS Groups
    Customers can configure groups of SaaS apps from our cloud app repository and export that information to ingest that information into third party SWG's for automated blocking. Currently, this feature supports Bluecoat (Broadcom) and PANW.
- Configuring notifications
  Admins can create custom notification objects that can be applied to policies and reports. This will determine which admins or users are notified when a policy is violated and what the custom message says.
- Setup traffic steering
  Forcepoint ONE SSE supports SmartEdge Agent and Cloud SWG traffic steering methods. This chapter describes steps to deploy each of those so that traffic can be forwarded to Forcepoint ONE SSE.
- Configuring SWG policies
  You can configure SWG Connection Policy, Cloud SWG Authentication Policy and SWG Content Policy to manage traffic through Cloud SWG and SmartEdge agent.
- Device Profiling Proxy
  The Device Profiling Proxy page will allow you to both configure the means to distinguish between a managed and an unmanaged device as well as implement a forward proxy deployment for applying inline policy actions.
- Configure Zero Trust Network Access
  Forcepoint ONE SSE's Agentless and Agent-based Zero Trust Network Access (ZTNA) provides an alternative to VPNs allowing admins to provide inline protection to internal apps without the need for VPN service to be running on the user's local machine.
- Configuring Advanced Threat Protection
  Forcepoint ONE SSE provides Advanced Threat Protection (ATP) via partnerships with Crowdstrike and Bitdefender.
- Encrypting data
  Forcepoint ONE SSE enterprise edition allows users to encrypt data at rest in cloud applications for both file and field level data. Keys can be managed in the Forcepoint ONE SSE Keystore or customers can add their own KMIP Key Store to utilize existing key management appliance/servers (KMS or HSM).
- Integration
IAM
Settings
Support
Deployment Guides
Other

Predefined DLP patterns

Predefined DLP patterns are those data patterns which are already available in Forcepoint ONE SSE and can be used while configuring policies.

Understanding Predefined File type based DLP patterns
Once predefined file type based DLP patterns are enabled on your tenant, the DLP Objects page displays three predefined DLP patterns for standard file types which can be used while configuring inline (ZTNA and CASB), SWG content and API policies to detect or block content based on file types.
Importing predefined DLP patterns
Forcepoint ONE SSE contains a large number of predefined DLP patterns based on commonly used objects including matching patterns for Credit Cards, sensitive keywords, U.S. Social Security Numbers, and more.

Copyright © 2024 Forcepoint LLC