Risk Levels

The risk level allows you to determine how significant, from a security perspective, the event controlled by a given DLP rule is.

This makes it possible to classify rules for events of different significance accordingly, for example, to mark access to a specific website differently from an attempt to copy a file containing protected data.

The risk level is defined by the administrator during rule configuration.

The risk level does not determine whether the rule will be executed. The rule's behavior results from its triggers and actions. The risk level is used to define the significance of the event and facilitates its later assessment.

Risk level scale

The risk level is defined numerically and can be assigned to one of three ranges:

Level	Range	Example meaning
Low	1-33	Events with low significance for security
Medium	34-66	Events requiring greater administrator attention
High	67-100	Events of high significance, related, for example, to the possibility of disclosing protected data

For example:

• low risk level can be used for access to a site belonging to the social media category,

• medium risk level may apply to access to a site belonging to the elevated-risk category,

• high risk level can be assigned to an attempt to copy a file containing personal data.

The examples above do not prescribe how events should be classified. The risk level should be aligned with the security policies in force within the organization.

The risk level allows you to determine the significance of the rule in the context of the organization's security.

How do you set the risk level?

The risk level is set during rule configuration.

1

Go to rule configuration

Create a new rule or open an existing rule for editing.

Configure the required triggers, actions, and notifications.

2

Go to risk level

In the rule configuration, go to the section Risk level.

A slider will be displayed to define the risk value.

3

Set the value

Move the slider and select the value corresponding to the significance of the given rule.

When determining the value, consider among other things:

• the type of controlled event,

• the type of data the event may involve,

• the possible consequences of a violation,

• the security policies in force within the organization.

4

Check the risk level

Based on the selected value, the rule will correspond to one of the levels:

• low,

• medium,

• high.

5

Assign the rule to a policy

After completing the configuration, click:

Assign to policy

The rule will be saved and assigned to the selected policy.

After completing the configuration, the rule must be assigned to the appropriate policy.

How do you choose the risk level?

Not every organization should classify the same events in the same way.

When determining the risk level, it is worth answering a few questions:

1. Can the event lead to data loss or disclosure?

2. What type of data may it involve?

3. Is the user performing a standard action or an unusual operation?

4. What may be the consequences of the event for the organization?

5. Does the event require a rapid administrator response?

On this basis, you can adopt your own classification method.

Example

The organization may establish the following rules:

Event	Example level
Access to a site from the monitored category	Low
Launching an unauthorized application	Medium
Connecting an unauthorized USB device	Medium or high
Attempting to copy a protected document	High
Attempting to send a file containing protected data	High

Do not treat the table above as a mandatory classification. The levels should reflect the actual risk resulting from the security policies and operating model of the organization.

Consistent rule classification

When you have a large number of rules, it is worth establishing internal rules for assigning risk levels.

For example:

• low - events that are primarily informational,

• medium - events requiring analysis or potentially indicating a policy violation,

• high - events that may lead to data loss, disclosure, or unauthorized use of data.

This approach makes it easier to maintain consistency among rules created by different administrators.

It is worth documenting the adopted classification method in the organization's internal documentation. This ensures that new rules are assessed according to the same criteria.

Changing the risk level

The configured risk level can be changed later.

To do this:

1

Open the rule

Go to the policy view, expand the appropriate policy, and open the rule for editing.

2

Change the risk value

Go to the section Risk level and set a new value.

3

Save the configuration

Save the changes to the rule.

4

Update policies

After changing the configuration, use the option:

Update policies

so that the latest configuration can be delivered to the eAgents.

FAQ

Does the system automatically set the rule's risk level?

No. The risk level is defined by the administrator during rule configuration.

This allows the classification to be aligned with the security policies in force in the organization.

Does a high risk level mean the event will be automatically blocked?

No. The risk level defines the significance of the event.

Whether the operation will be blocked or another response will be executed depends on the configured triggers and actions of the rule.

Can the risk level be changed later?

Yes. Open the rule for editing and set a new risk level value.

After saving the change, remember to update the policies.

What risk level should I set?

The level should be selected based on the significance of the event in the given organization.

Consider the type of data, the possible consequences of the event, and the required response method.

Can two similar rules have different risk levels?

Yes. The risk level is part of the configuration of a specific rule and can be adjusted to its purpose and scope of operation.