Forcepoint™ Security Management Center Service Online Documentation

Home
Policy Creation and Administration
Inspection & Content Filtering Policies
Inspection Policy Elements
Inspection Policy elements define how the Engines look for patterns in traffic allowed through the Access rules and what happens when a certain type of pattern is found.

Preface
This guide provides the information you need to work with your Forcepoint product.
Introduction to SMC as a Service
The SMC as a Service provides centralized access for configuring, managing, logging, and monitoring NGFWs that secure network connectivity and control business operations.
Getting Started
Routing
Policy Creation and Administration
- Overview
  Policies are key elements that contain rules for allowing or blocking network traffic and inspecting the content of traffic.
- Creating and managing policy elements
  Policy elements are containers for the rules that determine how Engines, Master Engines, and Virtual Engines examine traffic. The policy elements for the Engines include Template Policies, Policies, and Sub-Policies.
- Rule Types within Policies
- Policy Supporting Elements
- Inspection & Content Filtering Policies
  - Inspection Policy Elements
    Inspection Policy elements define how the Engines look for patterns in traffic allowed through the Access rules and what happens when a certain type of pattern is found.
    - Inspection Policy elements and how they work
      Inspection Policy elements define how the main traffic analysis is done for traffic that has been allowed and selected for deep inspection in the Access rules. They define what action the Engine takes when a match is found.
    - How Inspection Policy elements are designed
      Inspection Policy elements activate checks for specific traffic patterns and define what action the Engine takes when a match is found.
    - Set default options for Exception rules in Inspection Policy elements
      The Continue action allows you to set default values for some settings in Exception rules to avoid defining the same settings for several rules individually.
    - Example: Tuning an Inspection Policy element to eliminate false positives for an Engine
      An example of using Exception rules in the Inspection Policy element to eliminate a false positive.
  - Snort Inspection on Engines
    The Snort open source intrusion prevention system is integrated into Forcepoint Engine. You can import externally created Snort configurations into Forcepoint Engine to use Snort rule sets for inspection.
  - Anti-malware Scanning
    An anti-malware scanner compares network traffic against an anti-malware database to search for viruses and other malware. If malware is found, the traffic is stopped or content is stripped out.
  - File Filtering
    Monitoring and restricting what data is sent out is an important part of data loss prevention (DLP). File filtering allows you to restrict the file types that are allowed in and out through the Engine, and to apply malware detection to files.
  - Filtering URLs
    URL filtering allows you to filter URLs based on categories of content or lists of individual URLs.
  - Protocol Agents on Security Engines
    Protocol elements of the Protocol Agent type are special modules for some protocols and services that require advanced processing. Protocol Agents can enforce policies on the application layer.
  - Sidewinder Proxies
    Sidewinder Proxies are software modules that provide network level proxies, protocol validation, and configurable application level protocol filtering and translation on Forcepoint SMCaaS.
  - Setting up TLS Inspection
    The TLS inspection feature decrypts TLS connections so that they can be inspected for malicious traffic and then re-encrypts the traffic before sending it to its destination.
  - Quality of Service (QoS)
    The Quality of Service (QoS) features allow you to manage bandwidth and prioritize connections on the Engines. QoS features are available on Engines, Master Engines, Virtual Engines.
- Access Control & Authentication Policies
- Policy Troubleshooting & Maintenance
Monitoring
VPN

Inspection Policy Elements

Inspection Policy elements define how the Engines look for patterns in traffic allowed through the Access rules and what happens when a certain type of pattern is found.

Inspection Policy elements and how they work
Inspection Policy elements define how the main traffic analysis is done for traffic that has been allowed and selected for deep inspection in the Access rules. They define what action the Engine takes when a match is found.
How Inspection Policy elements are designed
Inspection Policy elements activate checks for specific traffic patterns and define what action the Engine takes when a match is found.
Set default options for Exception rules in Inspection Policy elements
The Continue action allows you to set default values for some settings in Exception rules to avoid defining the same settings for several rules individually.
Example: Tuning an Inspection Policy element to eliminate false positives for an Engine
An example of using Exception rules in the Inspection Policy element to eliminate a false positive.

Copyright © 2026 Forcepoint LLC