Use case: Block outbound messages with confidential content unless they are sent to a specified domain

Outbound messages are blocked if they contain the word Confidential, unless the recipient is exempt from the rule.

Expected behavior
Email contents Recipient Expected result
Body: Confidential external_user@external.com The message is blocked because it contains the word Confidential.
Body: Confidential internal_user@example.com The message is not blocked because the exception settings mean that confidential material can be sent to people at example.com.
Body:

Attachment: Confidential

external_user@external.com

internal_user@example.com

The message is blocked because one of the recipients is not allowed to receive it.

Task

  1. Create an email address list definition for a domain that is exempt from the rule.
    1. In the Data Protection section in McAfee ePO, select DLP Policy Manager and click Definitions.
    2. Select the Email Address List definition and create a duplicate copy of the built-in My organization email domain.
    3. Select the email address list definition you created, and click Edit.
    4. In Operator, select Domain name is and set the value to example.com.
    5. Click Save.
  2. Create a rule set with an Email Protection rule.
    1. Click Rule Sets, then select ActionsNew Rule Set.
    2. Name the rule set Block Confidential in email.
    3. Create a duplicate copy of the built-in Confidential classification.
      An editable copy of the classification appears.
    4. Click ActionsNew RuleEmail Protection Rule.
    5. Name the new rule Block Confidential and enable it.
    6. Enforce the rule on DLP Endpoint for Windows and DLP Prevent.
    7. Select the classification you created and add it to the rule.
    8. Set the Recipient to any recipient (ALL).
      Leave the other settings on the Condition tab with the default settings.
  3. Add exceptions to the rule.
    1. Click Exceptions, then select ActionsAdd Rule Exception.
    2. Type a name for the exception and enable it.
    3. Set the classification to Confidential.
    4. Set Recipient to at least one recipient belongs to all groups (AND), then select the email address list definition you created.
  4. Configure the reaction to messages that contain the word Confidential.
    1. Click Reaction.
    2. In DLP Endpoint, set the Action to Block for computers connected to and disconnected from the corporate network.
    3. In DLP Prevent, select the Add header X-RCIS-Action option and click the Block value.
  5. Save and apply the policy.