• Cloud App Security
• Understanding Cloud App Security
  • Understanding Email Security
    • Understanding Post-Delivery Email Recheck
  • Using Data Leak Protection
  • Understanding Anomalies
  • Understanding Click-Time Protection
• Configuring Cloud App Security
  • Subscribing to Cloud App Security
  • Activating Cloud Applications for Cloud App Security
  • Activating G Suite Cloud Applications
    • Using Cloud App Security with Google Cloud Directory Sync
• Managing Quarantine for G Suite
  • Setting Up a Quarantine Mailbox for Gmail
  • Setting Up a Quarantine Folder for Google Drive
  • Using the Quarantine View for Gmail
  • Using the Quarantine Page
  • Using the Quarantined File Creator Dashboard
  • Using the User Dashboard for G Suite
  • Managing Restore Requests
• Using the SonicWall Cloud App Security Dashboard
  • Using the Security Events Widgets
    • Changing a Security Event Widget to an Alert or Custom Query
    • Resetting a Security Event Widget
    • Hiding a Security Event Widget
    • Configuring Security Event Widget Custom Queries
    • Adjusting the Time Scale
  • Viewing the Summary of Security Events
  • Viewing Login Events
  • Viewing Secured Applications
  • Viewing the Scanned Files Summary
• Managing Security Events
  • Using the Security Event Graphs
    • Viewing Security Events by Severity
    • Viewing Security Events by State
    • Viewing Security Events by Cloud Application
  • Viewing and Acting on Security Events
    • Removing Filters
    • Acting on Security Events
  • Managing Multiple Events
• Managing Policies
  • Understanding Cloud App Security Policies
    • Before You Set Email Policies
    • Monitor only
    • Detect and Prevent
    • Protect (Inline)
  • Creating New Policy Rules
    • Creating Data Leak Protection Policy Rules
      • Using Regular Expressions in DLP Policies for Email
    • Creating Malware Policy Rules
    • Creating Threat Detection Policy Rules
    • Creating Policy Rules for Click-Time Protection
    • Creating Custom Query Policies
  • Stopping Policy Rules
  • Removing Policy Rules
• • Configuring Data Leak Protection Detection Rules
  • Reactivating Data Leak Protection
  • Predefined Data Leak Protection Policy Rules
    • Global Rules
    • Credentials and Secrets
    • Predefined Data Leak Protection Rules for Specific Countries
      • Argentina
      • Australia
      • Belgium
      • Brazil
      • Canada
      • Chile
      • China
      • Columbia
      • Denmark
      • Finland
      • France
      • Germany
      • Hong Kong
      • India
      • Indonesia
      • Ireland
      • Israel
      • Italy
      • Japan
      • Korea
      • Mexico
      • The Netherlands
      • Norway
      • Paraguay
      • Peru
      • Poland
      • Portugal
      • Singapore
      • Spain
      • Sweden
      • Taiwan
      • Thailand
      • Turkey
      • United Kingdom
      • United States
      • Uruguay
      • Venezuela
• Managing Spam and Anti-Phishing
  • Managing Spam
  • Customizing Warning Messages
  • Managing Nickname Impersonation
  • Managing the Anti-Phishing Exceptions
    • Managing Excluded Email Addresses
      • Adding Email Addresses to the Anti-Phishing Block-List
      • Removing Email Addresses from the Anti-Phishing Block-List
    • Managing Excluded IP Addresses
      • Adding IP Addresses to the Anti-Phishing Block-List
      • Removing IP Addresses from the Anti-Phishing Block-List
    • Managing Excluded Domains
      • Adding Domains to the Anti-Phishing Block-List
      • Removing Domains from the Anti-Phishing Block-List
    • Creating Block-List Rules from Email Messages
    • Managing the Anti-Phishing Allow-List
      • Creating Anti-Phishing Allow-List Rules from the Security Events Page
      • Creating Anti-Phishing Allow-List Rules from the Anti-Phishing Allow-List Page
    • Managing the Anti-Phishing Block-List
• Configuring and Using Click-Time Protection
  • Activating Click-Time Protection
  • Configuring Click-Time Protection
    • Configuring the Click-Time Protection Workflow
    • Configuring Custom Click-Time Protection for Specific Domains
      • Adding Custom Click-Time Protection for Specific Domains
      • Deleting Custom Click-Time Protection for Specific Domains
  • Using Click-Time Protection
    • Viewing Security Events for Click-Time Protection
    • Managing Email Messages with Click-Time Protection
    • Creating Custom Queries for Click-Time Protection
• Using Cloud App Security Analytics
  • Viewing the Summary Report
  • Viewing the Weekly Reports
  • Viewing Email Analytics
  • Viewing Google Drive Analytics
  • Viewing Shadow SaaS Analytics
  • Viewing and Creating Custom Queries
    • Creating Custom Queries
    • Adding Custom Queries to the Dashboard
• Configuring Cloud Applications in the Cloud App Store
  • Configuring G Suite for Cloud App Security
  • Re-Authorizing Cloud Applications
• Managing Security Applications in the Security App Store
  • Starting Security Applications
  • Stopping Security Applications
• Managing Anomaly Exceptions
  • Creating Exceptions Based on Anomaly Events
  • Sending Anomaly Event Notifications
• Managing Security Tool Exceptions
• Using the System Log
  • Viewing the System Log
  • Exporting the System Log
• Managing Cloud App Security Licenses
  • Adding Administrator Users
  • Adding Read-Only Users
  • Managing Group Licensing
  • Unassigning Cloud App Security Licenses
• SonicWall Support
  • About This Document

Creating Data Leak Protection Policy Rules

Data Leak Protection (DLP) helps protect your organization's data from potential data breaches or data ex-filtration transmissions. Data Leak Protection can scan emails and text messages posted on cloud application email and storage platforms, and detect data patterns that should not be shared with unauthorized persons or targets. For more information, see Using Data Leak Protection.

To create a DLP policy rule

1. In the Rule Name field, enter the name you want to use to identify the rule.
2. From the Mode dropdown list, select the mode in which you want the DLP policy rule to operate:
   • Monitor only
   • Detect and Prevent (cloud application storage only)
   • Protect (Inline) (email only)
3. In the Scope section, either:
   • Select All users and groups (all licensed users) to have the policy rule either apply to all users.
   • In the Specific users and groups list, select the specific users or user groups to which the policy should apply or be excluded from being applied.
4. In the DLP Criteria section:

   1. From the DLP Rules list, select the detection rules you want applied:

      • PII
      • PHI
      • Financial
      • Encrypted Content
      • Access Control
      • Intellectual Property
      • PCI
      • Resume
      • SOX
      • HIPAA

      For more information about the predefined DLP policy rules, refer to Predefined Data Leak Protection Policy Rules.

   2. From the Sensitivity list, select the sensitivity (based on the hit count) to be used to apply the rules.
   3. Select Skip internal items to have the rules not applied to items not shared with external users.

   Depending on the type of cloud application and the Mode, you may see a different set of options in the Advanced section.

5. In the Advanced > Actions section:

   1. Select Send files with sensitive data to vault to send the affected files to a secure vault location.

      A vault is a secure location accessible only to users with specific access privileges (such as a data privacy team). It is a different location that the quarantine area defined in your Cloud App Security cloud application configuration.

   2. Select Alert admin(s) to notify administrators when a possible leak is detected.
      • Click the gears icon to modify the email message sent to administrators.
      • Click the users icon to select which administrators should receive the message.
   3. Select Alert file owner to notify the user sharing the file when a possible leak is detected.
      • Click the gears icon to modify the email message sent to the file owner.
   4. Select Quarantine drive files to quarantine detected files to the quarantine folder defined in your Cloud App Security configuration.
6. From the DLP Workflow list, select which action should be taken when a possible leak is detected:
   • Email is blocked. User is alerted and allowed to request a restore (admin must approve)
   • Email is blocked. User is alerted and allowed to restore the email
   • Email is allowed. Header is added to the email

   • Email is allowed. Encrypted by Microsoft

     This action is only visible and available if you subscribe to Microsoft encryption services and have encryption enabled.

     Encrypted Office 365 and Microsoft 365 Email support requires that you have the necessary Office 365 and Microsoft 365 or Exchange Online subscription level from Microsoft and a Cloud App Security Advanced license from SonicWall.

     For more information about using Encrypted Office 365 and Microsoft 365 Email support with Cloud App Security, refer to Working with Office 365 and Microsoft 365 Email Encryption.

   • Do nothing
7. In the Advanced > Alerts section:
   1. Select Send email alert to notify specific users when a possible leak is detected.
      • Click the gears icon to modify the email message sent to the file owner.
8. Click Save and Apply.