Installing Forcepoint DLP agents

The following Forcepoint DLP agents can be installed. With the exception of the protector, mobile agent, and Forcepoint DLP Network, agents are installed using the Custom option of the standard Forcepoint Security Installer.

Note that agents become available only when the installation performed on a server that meets the agent’s requirements. For example, the FCI agent is only shown as an option on machines with Microsoft FSRM installed.

For instructions on how to install the agents, see the Forcepoint DLP Installation Guide.

Agent	Description	When to Use	Location
Protector	The protector is a standard part of Forcepoint DLP deployments. It is a physical or soft appliance with a policy engine and a fingerprint repository, and it supports analysis of SMTP, HTTP, FTP, plain text, and IM traffic that doesn't use SSL. For blocking HTTPS traffic, the protector can integrate with proxies using ICAP.	Monitor/block: network email Monitor: HTTP, FTP, plain text, IM Monitor/block: HTTP via ICAP	On premises
Web Content Gateway	The Web Content Gateway module is included with Forcepoint DLP Network. It provides DLP policy enforcement for the web channel, and offers SSL traffic decryption. This component permits the use of custom policies, fingerprinting, and more. It also makes use of the Forcepoint URL category database to define DLP policies for the web channel.	Monitor/block: HTTP/S with SSL decryption	On premises
Analytics Engine	The analytics engine is used to calculate the relative risk of user activity, correlate it with similar activity, and assign it a risk score.	High risk incident scoring	On premises Virtual appliance
Crawler	The crawler performs discovery and fingerprinting scans. The crawler is installed automatically on the management server and supplemental Forcepoint DLP servers. To improve scanning performance in high transaction volume environments, it can also run standalone.	Discovery/ Fingerprinting	On premises
Forcepoint DLP Endpoint	The endpoint client software monitors all data activity on endpoint machines and reports on data at rest on those machines. Forcepoint DLP Endpoint can monitor application operations such as cut, copy, paste, and print screen. It can also block users for copying files, or even parts of files, to endpoint devices such as thumb drives, CD/DVD burners, and Android phones, among other features.	Monitor/block: email, printing, application control, LAN control, HTTP/S, removable media Local discovery	Endpoint devices

Important: Forcepoint DLP agents and machines with a policy engine (such as a Forcepoint DLP Server or Web Content Gateway appliance) must have direct connection to the Forcepoint management server. When deployed in a DMZ or behind a firewall, the relevant ports must be allowed.