Create data-in-motion rules - Administrator Guide - Cortex XSIAM - Cortex - Cortex CLOUD - Cortex - Security Operations

In Modules → Data Security → Endpoint Data-in-Motion Rules → Data-in-Motion Rules click Create New Rule.

On the General page:

1. Enter a unique name and description.

2. Choose the Action to implement when the rule criteria are met, such as blocking the transfer or notifying relevant parties.

3. Select the Action for Partial Classification to implement when partial classification occurs. Partial classification refers to a situation where the classification process is incomplete, such as due to a timeout or classification failure.

4. Select the Severity of the rule you are creating.

   The Informational action enables logging an activity without interfering with the user’s workflow.

5. Enter a Raised Issue Name that will be used as the name for the issue created as a result of policy breaches.

6. Select to Disable/Enable Rule as required.

On the Context & Data page:

1. For Source, select the Custom Web Application Groups

   The source is the origin of the data, whether it resides on a local drive (such as a PDF on a laptop) or within a web application (such as a file in OneDrive).

   Without a defined source, this rule applies to every file by default. You can make the policy more targeted by selecting a specific source.

   Note

   Third-party application behaviour:

   • When a file upload is blocked, the local application may display its own generic error message in response to the DLP restriction. In similar cases, some third-party applications might still proceed by sending a dummy file or an error placeholder instead of the actual data.

2. For Destination, select the relevant Application Groups. Refer to Create endpoint application groups for more information.

   Selecting Allow corporate accounts users to upload, lets corporate account users bypass the Block rule action and upload data from the web application.

   USB Channel: Select File Write/Copy to USB to enforce the rule on the USB device.

3. For Data Scope , select the relevant Data Profile.

   Note

   To maximize data security, if you use Microsoft Purview for extensive manual and automated file classification tagging and are looking to integrate those labels directly with the DLP policies to trigger protective actions based on a file's sensitivity, refer to How to use information protection labels in Cortex Cloud Data Security.

On the Target page:

On the User Interaction page, you can add the default pop-up message for each of the following events.

1. For End User Dialog, toggle ON/OFF to manage whether users see a message when the policy is violated.

2. In the Title, enter the default name for the dialog.

3. In the Body, enter the message to display in the dialog. You can choose to use the system's default text. This is also relevant for Reporting Mismatch and Rule Override.

   If enabled, the Rule Override allows the user to override the block policy and temporarily retry the operation (to move the file again) to complete the action. The user's response is recorded as part of the Issue.

4. In the Admin Email Link, enter the default admin email that will be added to the body.

5. In the Dialog Main Button Label, enter the text to use for the button to close the window.

Click Next to create the rule.

From the Data-In-Motion Rules table, click Save or move the rule down to change the priority, and then click Save.