Rules

The rule defines what the system is to detect and how it is to respond to a specific event.

Each rule belongs to a DLP policy and can include:

• one trigger,

• configured actions (multiple),

• notifications (multiple).

A sample rule can detect the connection of a specific USB device, block an unauthorized operation, and send a notification to the administrator.

The policy defines the scope of protection, while the rule defines the system's specific behavior within that scope.

Where are the rules located?

Go to:

Data Protection -> Rules -> Policies

Rules are displayed within the policies to which they have been assigned.

To view the rules belonging to the selected policy, click its name.

Expanding a policy displays all rules assigned to it.

What does a rule consist of?

Rule configuration is based on three basic elements:

Element	Meaning
Trigger	Defines the event or condition that starts the rule
Action	Defines the action performed when the conditions are met
Notification	Defines whether and to whom information about the event is to be sent

Example:

Trigger: the user connects a USB device that meets specified conditions.

Action: the system blocks the unauthorized operation.

Notification: the administrator receives information about the event.

Not every rule has to block user activity. Depending on the configuration, it can also be used to monitor and log specific events.

Adding a rule

You can create a new rule within an existing policy.

1

Expand the policy

In the Policies click the name of the policy to which you want to add a rule.

A list of the rules assigned to it will be displayed.

2

Add a rule

Click:

+ Add rule

A new rule configuration tab will open.

The new rule is created within the selected policy.

3

Configure the rule

Specify the required rule elements, in particular:

• name,

• triggers,

• actions,

• notifications.

• risk level

The individual mechanisms are described in detail in the following sections of the documentation.

4

Save the rule

After completing the configuration, save the rule.

The name of the saved rule will be visible on its tab and within the policy to which it was assigned.

5

Update policies

After saving the rule, return to the policies view and click:

Update policies

This will allow the modified configuration to be delivered to the eAgents.

Saving a new rule in the console does not yet mean that computers are using its latest version. After completing the configuration, remember to use the option Update policies.

Working with rule tabs

When creating or editing a rule, its configuration opens in a separate tab at the top of the view.

You can have several rule tabs open at the same time.

The tab name corresponds to the name of the rule currently being edited and may change after the changes are saved.

Tabs let you switch between the rules currently open.

If you start creating a new rule, save the configuration before closing its tab. Unsaved work may be lost.

Editing a rule

You can modify an existing rule without creating it from scratch.

1

Find the rule

Expand the policy containing the rule you want to change.

2

Open editing

Click the edit icon next to the selected rule.

Rule edit icon.

The rule will open in a separate tab.

3

Change the configuration

Depending on your needs, you can change, among other things:

• the rule name,

• triggers,

• their parameters,

• actions,

• notifications.

4

Save changes

After finishing editing, save the rule configuration.

5

Update policies

After changing the rule, click Update policies, so that the new configuration can be delivered to the eAgents.

Before changing an active rule, check the scope of the policy to which it belongs. The change may affect all devices and users covered by that policy.

Copying a rule

If a similar configuration is to be used in another policy, you do not need to create the rule from scratch.

Function Copy creates a copy of an existing rule in the selected policy. The original rule remains in the current policy.

1

Select the rule

Expand the policy and find the rule you want to copy.

2

Open copy or move

Click the Copy/Move icon next to the selected rule.

Copy/Move.

3

Select the Copy option

In the window that opens, select:

Copy

4

Select the target policy

Select the policy to which the copy of the rule is to be added.

When copying a rule, you must specify the policy in which its copy is to be created.

5

Save the operation

Confirm the copying.

The original rule will remain in the current policy, and its copy will be added to the specified policy.

After copying, two independent rules are created. Later editing of one of them does not automatically change the other.

Moving a rule

Function Move allows you to change the policy to which an existing rule belongs.

Unlike copying, no second rule is created - the existing configuration is removed from the current policy and assigned to the target policy.

1

Select the rule

Expand the policy containing the rule you want to move.

2

Open copy or move

Click the Copy/Move.

Rule edit icon.

3

Select the Move option

In the window that opens, select:

Move

Move option.

4

Select the target policy

Select the policy to which the rule is to be moved.

5

Confirm the operation

After confirmation, the rule will be removed from the current policy and assigned to the specified policy.

6

Update policies

After changing the assignment, use the option Update policies.

Moving a rule changes its scope of operation. Before performing the operation, check the assignments of the source and target policies, as they may cover different users or devices.

Copying vs. moving

Operation	What happens to the source rule?	What is created in the target policy?
Copy	Remains in the current policy	New copy of the rule
Move	Is removed from the current policy	The same rule is assigned to the new policy

If you want to use a similar configuration in two policies, use the option Copy. If the rule has been assigned to the wrong policy and is to apply only in another one, use the option Move.

Deleting a rule

You can delete a rule that is no longer needed.

1

Find the rule

Expand the policy containing the rule intended for deletion.

2

Select Delete

Click the deletion icon next to the rule.

Deletion icon.

3

Confirm the operation

Confirm rule deletion.

The operation is irreversible.

4

Update policies

After deleting the rule, use the option Update policies, so that the change can be delivered to the eAgents.

Rule deletion becomes permanent only from the Archive view. If the configuration may still be needed, it can be restored.

Permanent deletion requires confirmation of the logged-in user's credentials.

When to use which operation?

If you want to:

• change the behavior of an existing rule - use Edit,

• use a similar configuration in another policy - use Copy,

• change the policy to which the rule belongs - use Move,

• completely remove the configuration - use Delete.

Best practice

When you have a large number of rules, use names that indicate both the monitored event and the expected response.

Instead of:

USB 1

it is better to use:

USB - unauthorized media blocked

Instead of:

WWW

it is better to use:

WWW - blocked prohibited categories

This makes it possible to identify the purpose of the rule without opening its configuration.

If you are creating a new rule based on an existing configuration, it is safer to copy it first and only then modify it. The original rule will remain unchanged.

FAQ

Can one rule belong to several policies at the same time?

Not as a single shared rule. If the same configuration is to be used in another policy, you can use the Copy.

A copy of the rule will then be created in the target policy, and it can later be edited independently.

What is the difference between copying and moving a rule?

Copying leaves the original rule in the current policy and creates a copy of it in the target policy.

Moving removes the rule from the current policy and assigns it to another one.

Will changing a copied rule also change its original?

No. After copying, they are independent rules and can be configured separately.

After editing a rule, does the change take effect on computers immediately?

No. After saving the changes, use the option Update policies, so that the latest configuration can be delivered to the eAgents.

Can a deleted rule be restored?

YES. Rule deletion becomes permanent only from the Archive. If the configuration may still be needed, it can be restored.

Where is the rule behavior configured?

Rule behavior is defined using triggers, actions, and notifications.

Each of these elements is described in detail in the following sections of the documentation.