User Guide

Contents
xiii
AsyncOS 9.1.2 for Cisco Email Security Appliances User Guide
RSA Email DLP 17-4
How to Set Up Data Loss Prevention for Deployments Using RSA Email DLP 17-4
Enabling Data Loss Prevention (RSA Email DLP) 17-5
DLP Policies for RSA Email DLP 17-6
DLP Policy Description 17-6
Predefined DLP Policy Templates 17-6
Setting Up RSA Email DLP Using a Wizard 17-7
Creating a DLP Policy Using a Predefined Template 17-8
Creating a Custom DLP Policy (Advanced) 17-9
About Defining Disallowed Content Using Content Matching Classifiers 17-10
Filtering Messages for DLP Policies 17-20
About Assessing Violation Severity 17-21
Arranging the Order of the Email DLP Policies for Violation Matching 17-21
Associating DLP Policies with Outgoing Mail Policies 17-22
Important Information About Editing or Deleting DLP Policies 17-23
RSA Enterprise Manager 17-23
How Enterprise Manager and the Email Security Appliance Work Together 17-24
Enterprise Manager Documentation 17-24
How to Set up Data Loss Prevention in Deployments with RSA Enterprise Manager 17-24
Migrating from RSA Email DLP to RSA Enterprise Manager 17-31
Checking for DLP Policy Updates from Enterprise Manager 17-32
RSA Enterprise Manager and Language Support 17-32
Using Enterprise Manager with Clustered Appliances 17-32
About Deleting and Disabling Policies in Enterprise Manager Deployments 17-33
Lost Connectivity Between the Email Security Appliance and Enterprise Manager 17-33
Switching from Enterprise Manager to RSA Email DLP 17-33
Message Actions 17-34
Defining Actions to Take for DLP Violations (Message Actions) 17-34
Viewing and Editing Message Actions 17-36
Drafting DLP Notifications 17-36
Showing or Hiding Sensitive DLP Data in Message Tracking 17-38
About Updating the DLP Engine and Content Matching Classifiers 17-39
Determining the Current Version of the RSA DLP Engine 17-39
Caveats for DLP Updates 17-40
Updating the DLP Engine and Content Matching Classifiers Manually 17-40
Enabling Automatic Updates (Not Recommended) 17-40
DLP Updates on Centralized (Clustered) Appliances 17-41
Rolling Back DLP Updates 17-41
Working with DLP Incident Messages and Data 17-41