Configuring DLP Actions and Notifications

Procedure

1. Go to one of the following:
   • File Transfer Scan → DLP Policies → Add
   • Instant Message Scan → DLP Policies → Add
2. Go to the Delivery Option and Notifications screen.
3. Specify the actions that IM Security takes on detections that match the rule criteria.
   • Delivery Option:
     • For File Transfer Scan, select Cancel file transfer or Deliver.
     • For Instant Message Scan, select Cancel instant message, Replace all, or Deliver.
   • Archive Option: Select to Archive or Do not archive files.
4. Select the person or people to send a notification to when IM Security detects a threat or policy detection (Administrator, Sender, or Recipient) and configure the notification options.
   • Specify any of the available notification methods (Email, Instant message, and SNMP).

     Note For Administrators, specify the administrator email address and instant messaging address in the text boxes provided, or configure the global administrator notification settings on the Administrator Notification screen. For details, see Configuring Administrator Notification Settings.

   • Modify the default message by clicking the Settings link.

     Note A list of available message variable tokens displays to the left of the message body details. To insert a variable token in the message body, select the variable token and click the arrow button.

     Click Save.
5. Select Write to Windows event log to have IM Security write the notification to a Windows event log.
6. Click Next >.