Data Loss Prevention

Hi guys,

How I want to create a response rule (email notification) for endpoint that monitor application such as outlook and IE?

Thanks

Specifying what applications are monitored is done through the Endpoint Agent Configuration.  So if I specify the applications for IE and Outlook then they will be monitored.

WHat exactly do you mean "create a response rule"? 

If you are monitoring those applications in the Endpoint Agent confguration then they will create DLP Incidents based on your policy like they should and then a response rule owuld be trigged normally.

Make sense?

JJ

Hi JJ,

For now my endpoint agent monitored for IE and Outlook application, and the incident generated accordingly but how I want to set a response rule for the incident that come from Outlook which is it coming from endpoint agent via application monitoring?

In response rule settings there is no condition to call for Endpoint Aplication. can I use SMTP protocol as the condition?

Thanks

Yes,

Use the SMTP block rule based on the protocol SMTP.

This should then do what you want.

Good Luck

Ronak

IF THIS ANSWERS YOUR QUESTION PLEASE MARKED THIS AS SOLVED

THe Endpoint agent is indded capturing the sender email address so you could build your response rule around the protocol (SMTP) and then trigger it accordlinly

Please make sure to mark this as a solution to your problem, when possible.