Best practices for Data Loss Prevention Enforce

Products

• Data Loss Prevention Enforce

Issue/Introduction

Learn about the best practices for installing, upgrading, configuring, and managing Symantec Data Loss Prevention (DLP) Enforce.

Resolution

Contents

• Install planning
• Configuration
• Disaster recovery
• Policies
• Detection methods
• Security
• Response rules

Note: Some of these best practices reside in the DLP Help Center for 15.8  and 16.0. For earlier versions, go to the versions field on the right-hand side of the title and select Legacy.

Install planning

• Configure Active Directory authentication for DLP
• DLP Vector Machine Learning best practices - 15.8 / 16.0

Configuration

• Change the hostname of the DLP Enforce Server

Disaster recovery

• Backup best practices for DLP
• Creating the Enforce Reinstallation Resources file (broadcom.com)
• Restore DLP Enforce across platforms in three-tier deployments

Policies

• Best practices for authoring policies -15.8  / 16.0
• Best practices for using regular expression matching - 15.8 / 16.0

Detection methods

Detection method	Description
EDM	Best practices for using EDM
IDM	Best practices for using IDM
VML	Best practices for using VML
Data identifiers	Best practices for using data identifiers
Keywords	Best practices for using keyword matching
Regular expressions	Best practices for using regular expression matching
Non-English language detection	Best practices for detecting non-English language content
File properties	Best practices for using file property matching
Network protocols	Best practices for using network protocol matching
Endpoint events	Best practices for using endpoint detection
Described identities	Best practices for using described identity matching
Synchronized DGM	Best practices for using synchronized DGM
Profiled DGM	Best practices for using profiled DGM
Metadata detection	Best practices for using metadata detection

Security

• Exclude DLP files and directories from antivirus scans

Response rules

• Response rule best practices

Services

• Restart DLP Enforce services in the correct order
• Restart the Enforce services in the correct order with a script on Windows
• Data Loss Prevention : RHEL Services will not auto start on reboot