Configuring Data Loss Prevention Notification for Administrators

Go to Administration > Notifications > Administrator.

On the Criteria tab:

Go to the Digital Asset Transmissions section.
Specify whether to send notifications when transmission of digital assets is detected (the action can be blocked or passed) or only when the transmission is blocked.

On the Email tab:

Go to the Digital Asset Transmissions section.
Select Enable notification via email.

Select Send notifications to users with agent tree domain permissions.

Use Role-based Administration to grant agent tree domain permissions to users. If transmission occurs on any agent belonging to a specific domain, the email are sent to the email addresses of the users with domain permissions. See the following table for examples:

Table 1. Agent Tree Domains and Permissions
Agent Tree Domain	Roles with Domain Permissions	User Account with the Role	Email Address for the User Account
Domain A	Administrator (built-in)	root	mary@xyz.com
	Role_01	admin_john	john@xyz.com
	Role_01	admin_chris	chris@xyz.com
Domain B	Administrator (built-in)	root	mary@xyz.com
Domain B	Role_02	admin_jane	jane@xyz.com

If any Security Agent belonging to Domain A detects a digital asset transmission, the email will be sent to mary@xyz.com, john@xyz.com, and chris@xyz.com.

If any Security Agent belonging to Domain B detects the transmission, the email is sent to mary@xyz.com and jane@xyz.com.

Note:

When enabling this option, all users with domain permissions must have a corresponding email address. The email notification will not be sent to users without an email address. Users and email addresses are configured from Administration > Account Management > User Accounts.

Select Send notifications to the following email address(es) and then type the email addresses.

Accept or modify the default subject and message. Use token variables to represent data in the Subject and Message fields.

Table 2. Token Variables for Data Loss Prevention Notifications
Variable	Description
%USER%	The user logged on to the endpoint when transmission was detected
%COMPUTER%	Endpoint where transmission was detected
%DOMAIN%	Domain of the endpoint
%DATETIME%	Date and time transmission was detected
%CHANNEL%	The channel through which transmission was detected
%TEMPLATE%	The digital asset template that triggered the detection
%RULE%	The rule name that triggered the detection Note: To display the rule name in the message, add this variable in the Message field.

On the SNMP Trap tab:

Go to the Digital Asset Transmissions section.
Select Enable notification via SNMP trap.
Accept or modify the default message. Use token variables to represent data in the Message field. See Table 2 for details.

On the NT Event Log tab:

Go to the Digital Asset Transmissions section.
Select Enable notification via NT Event Log.
Accept or modify the default message. You can use token variables to represent data in the Message field. See Table 2 for details.

Click Save.