Forcepoint

---
name: forcepoint
description: "Expert agent for Forcepoint DLP. Covers risk-adaptive protection, dynamic data protection, behavioral analytics, endpoint/network/cloud/email DLP policy configuration, incident management, and Forcepoint ONE integration. WHEN: \"Forcepoint DLP\", \"Forcepoint ONE\", \"dynamic data protection\", \"risk-adaptive DLP\", \"Forcepoint endpoint\", \"Forcepoint email DLP\", \"Forcepoint web DLP\", \"behavioral analytics DLP\"."
license: MIT
---

# Forcepoint DLP

This skill covers Forcepoint Data Loss Prevention, covering on-premises deployment, cloud deployment via Forcepoint ONE, risk-adaptive protection with behavioral analytics, and DLP policy management across endpoint, network, email, and cloud channels.

## How to Approach Tasks

1. **Identify deployment model** — Forcepoint DLP on-premises (Security Manager), Forcepoint ONE (cloud-native SaaS), or hybrid
2. **Identify enforcement channel** — Endpoint, email, web/proxy, network, cloud (CASB)
3. **Classify the request:**
   - **Policy configuration** — Apply Forcepoint policy builder guidance
   - **Risk-adaptive / behavioral** — Load dynamic data protection guidance
   - **Incident investigation** — Use incident management workflow
   - **Data discovery** — Apply Forcepoint Data Discovery guidance
   - **Integration** — Refer to Forcepoint ONE or SIEM/SOAR integration

## Platform Architecture

### Deployment Components

**Forcepoint DLP (on-premises/hybrid):**
```
Forcepoint Security Manager (FSM)
├── Management console (Windows-based web UI)
├── Policy engine — centralizes policy definitions
├── Incident management — stores and manages DLP incidents
│
├── Enforcement Modules
│   ├── Endpoint agent (Windows, macOS) — monitors endpoint activities
│   ├── Network agent (Email Gateway integration) — SMTP inspection
│   ├── Web proxy integration — HTTP/HTTPS upload inspection
│   ├── DLP ICAP server — integrates with web proxies via ICAP protocol
│   └── Discover agents — crawl file shares, SharePoint, cloud storage
│
└── Detection Engines
    ├── 1,700+ built-in content classifiers
    ├── Pattern detection (regex, keywords, data identifiers)
    ├── Drip DLP (detect slow-drip exfiltration over time)
    └── OCR engine (extract text from images)
```

**Forcepoint ONE (cloud-native):**
```
Forcepoint ONE Platform
├── Cloud-native SaaS delivery (no on-prem servers)
├── SASE architecture (SSE + SD-WAN)
├── DLP engine embedded in:
│   ├── SWG (Secure Web Gateway) — web upload inspection
│   ├── CASB — cloud app inspection (API + inline)
│   └── ZTNA — private app data protection
└── Same policy engine as on-prem (policy portability)
```

### Risk-Adaptive Protection (Dynamic Data Protection)

Forcepoint's differentiating feature: user behavior analytics (UBA) drives DLP enforcement levels.

**Risk scoring engine:**
```
Data sources feeding risk score:
  ├── Forcepoint DLP activities (policy violations, overrides)
  ├── UEBA signals (Forcepoint UEBA or integrated third-party)
  ├── Endpoint behavioral anomalies
  └── Cloud application activity

Risk levels:
  0-20:  Normal — standard DLP policies apply
  21-40: Low risk — additional monitoring, some policy tips
  41-60: Moderate risk — stricter enforcement on sensitive data
  61-80: High risk — block exfiltration attempts, increased monitoring
  81-100: Critical risk — maximum restrictions, security team alerted

Dynamic policy assignment:
  → User's current risk level maps to a DLP protection level
  → Higher risk = more restrictive DLP rule set automatically applied
  → Resets over time if no additional risk signals
```

**Configuring dynamic data protection:**
1. Security Manager → Dynamic User Protection
2. Define risk score tiers and corresponding DLP protection levels
3. Link protection levels to DLP policy rule groups
4. Enable behavioral analytics data feed (UEBA integration or built-in signals)
5. Test with pilot user group before production deployment

## Policy Configuration

### Policy Architecture

```
DLP Policy
├── Rules (ordered, first match wins by default)
│   ├── Rule conditions:
│   │   ├── Content classifier (data identifier, pattern, dictionary, ML classifier)
│   │   ├── Destination (email domain, URL category, cloud app, device type)
│   │   ├── User/group (Active Directory users or groups)
│   │   ├── Source application (browser, email client, USB device)
│   │   └── Sensitivity level (based on file classification)
│   │
│   └── Rule actions:
│       ├── Monitor (log only, no user impact)
│       ├── Confirm (show user a warning; they can proceed)
│       ├── Encrypt (apply email encryption for email channel)
│       ├── Block (prevent the action)
│       ├── Redirect (send to alternative destination, e.g., secure email)
│       └── Quarantine (move file to quarantine location)
│
└── Scope
    ├── User/group scope (who the policy applies to)
    └── Channel scope (which enforcement points enforce this policy)
```

### Channels and Actions Matrix

| Channel | Monitor | Confirm | Block | Encrypt | Quarantine |
|---|---|---|---|---|---|
| Email (outbound SMTP) | Yes | Yes | Yes | Yes | Yes |
| Web (HTTP/HTTPS upload) | Yes | Yes | Yes | No | No |
| Endpoint USB | Yes | Yes | Yes | No | Yes |
| Endpoint clipboard | Yes | Yes | Yes | No | No |
| Endpoint print | Yes | Yes | Yes | No | No |
| Cloud app (CASB) | Yes | Yes | Yes | No | Yes |
| Network (LAN) | Yes | No | No | No | No |
| Endpoint cloud sync | Yes | Yes | Yes | No | No |

### Built-in Content Classifiers

Forcepoint includes 1,700+ pre-built classifiers organized by:

**By regulation:**
- PCI DSS classifiers (credit card data, cardholder data environment)
- HIPAA classifiers (PHI, medical record numbers, DEA numbers)
- GDPR classifiers (EU personal data types by country)
- GLBA classifiers (financial account information)
- ITAR/EAR classifiers (export-controlled technical data)

**By data type:**
- Financial data (account numbers, routing numbers, financial statements)
- Healthcare data (diagnoses, medications, insurance information)
- Personal identification (SSN, passport, national IDs by country)
- Intellectual property (source code, design files, trade secrets)
- Legal documents (contracts, NDAs, litigation materials)

**Classifier types:**
```
Data identifiers: Pattern + validation + proximity keywords
  → Credit card: regex + Luhn checksum + keyword proximity
  → SSN: regex + format validation + keyword context

Keyword dictionaries: Lists of specific terms
  → Project codenames, executive names, product names
  → Useful for: protecting specific business-sensitive terms

Machine learning classifiers:
  → Trained on document type corpora
  → Pre-built: financial statements, HR docs, legal docs, source code
  → Custom: train on your own document samples (minimum 50 per class)

Drip DLP classifiers:
  → Tracks cumulative data volume per user over time window
  → Alerts when user sends X MB of sensitive data in Y days
  → Catches slow-leak exfiltration that bypasses per-event thresholds
```

### Email DLP Configuration

Forcepoint DLP integrates with email gateways via:
- **Forcepoint Email Security** (native integration — preferred)
- **Microsoft Exchange** (journal-based or MTA integration)
- **Third-party MTA** (SMTP proxy or journaling)

**Email policy configuration:**
```
Security Manager → Policy → Rules → Add Rule
  Condition:
    → Content classifier: [Credit Card Number, US SSN]
    → Destination: External email (not *.company.com)
    → Attachment type: Any
  
  Action: Block (with optional user notification)
  Notification message: "This email may contain sensitive financial data and has been blocked.
                         Please use the secure email portal for sending PII."
  
  Incident severity: High
  Incident assignment: Security Operations queue
```

**Handling encryption vs. block decisions:**
- Block: Use when content must not leave under any circumstances
- Encrypt: Use when content can leave but must be protected in transit
  - Requires: Forcepoint Email Security with encryption module or integration with ZixGateway/Proofpoint Encryption
  - Configuration: Action → Encrypt → Apply encryption profile

### Endpoint DLP Configuration

**Endpoint agent deployment:**
```
Windows:
  → MSI package deployed via SCCM, Intune, or Group Policy
  → Supported: Windows 10, 11, Windows Server 2016+
  → Requires: .NET 4.8+, WFP (Windows Filtering Platform) for network inspection

macOS:
  → PKG package deployed via JAMF or other MDM
  → Supported: macOS 10.15 (Catalina)+
  → Requires: System Extension approval, Full Disk Access
```

**Endpoint activities monitored:**
```
File operations:
  → Copy to removable media (USB, CD/DVD)
  → Copy to network share (UNC path)
  → Upload via browser (requires browser plugin)
  → Print / print to file
  → Cloud sync clients (OneDrive, Dropbox, Google Drive, Box)
  → FTP client transfers
  → Bluetooth file transfer

Application operations:
  → Copy/paste via clipboard (between applications)
  → Screen capture (detect application taking screenshots)
  → File attachment in email clients (Outlook, Thunderbird)

Communication:
  → Instant messaging attachments (Teams, Slack — via browser plugin)
  → Webmail uploads (Gmail, Yahoo, Hotmail — via browser plugin)
```

**Offline mode:**
- Endpoint agent caches policy locally
- Continues enforcing even when disconnected from FSM
- Queues events locally; uploads when reconnected
- Configurable: stricter policies for off-network (higher risk posture for unknown locations)

### Data Discovery

Forcepoint Data Discovery scans repositories for sensitive data at rest.

**Supported repositories:**
- Windows file shares (SMB)
- SharePoint (on-premises and Online)
- Exchange mailboxes
- OneDrive
- Box, Dropbox, Google Drive (via CASB API)
- Databases (via JDBC connector — Oracle, SQL Server, MySQL)

**Discovery workflow:**
```
1. Create Discovery Policy
   → Specify classifiers to detect (same as DLP policy classifiers)
   → Set minimum confidence level

2. Define scan targets
   → File share: \\server\share
   → SharePoint: https://sharepoint.contoso.com/sites/HR
   → Exchange: Mailbox range or distribution group

3. Schedule scan
   → Full scan: initial baseline
   → Incremental scan: new/modified files only (recommended for ongoing)
   → Frequency: daily/weekly depending on data change rate

4. Review discovery incidents
   → Security Manager → Incidents → Discovery
   → Prioritize by sensitivity level and location exposure
   → Remediate: move, delete, encrypt, apply rights management, or accept risk
```

### Incident Management

**Incident workflow:**
```
DLP Event → Incident Created
     │
     ├── Auto-assigned based on:
     │   ├── Policy owner (policy has an assigned owner)
     │   ├── Severity-based queue routing
     │   └── Business unit of the violating user
     │
     ├── Incident states:
     │   ├── New → Opened → In Progress → Closed (False Positive / Resolved)
     │
     ├── Incident enrichment:
     │   ├── User's AD attributes (department, manager)
     │   ├── Device information (managed/unmanaged, location)
     │   ├── File evidence (snippet of content that triggered the policy)
     │   └── Historical violations by this user
     │
     └── Response actions available:
         ├── Request justification from user (automated workflow)
         ├── Alert manager/HR
         ├── Revoke user's network access (via integration)
         └── Export incident report for audit/legal
```

**Incident tuning to reduce noise:**
```
Strategies:
1. Increase minimum occurrence count (require 3+ credit cards vs. 1)
2. Raise confidence threshold for ML classifiers
3. Add whitelist entries for known-safe recipients/domains
4. Create "trusted sender" exclusion for internal business processes
5. Review and close false positives — FSM learns from FP markings
```

### Forcepoint ONE Cloud Integration

When using Forcepoint ONE (SSE/SASE cloud platform):

**Policy synchronization:**
- On-prem FSM policies can be published to Forcepoint ONE
- Single policy authoring location; enforced in both environments
- Policy versioning maintained; rollback available

**Cloud channels covered:**
```
Forcepoint ONE SWG (Secure Web Gateway):
  → HTTPS inspection with SSL break-and-inspect
  → DLP applied to all web uploads
  → Enforced for all users via cloud proxy (agent or PAC file)

Forcepoint ONE CASB:
  → API mode: scan cloud storage (Box, Salesforce, Google Drive, M365)
  → Inline mode: inspect uploads/downloads in real-time
  → Shadow IT blocking for unsanctioned apps
```

## SIEM Integration

**Supported integrations:**
- Syslog (CEF format) — Splunk, QRadar, ArcSight
- LEEF format — IBM QRadar native
- Email notification — for critical incidents
- REST API — pull incident data programmatically
- Microsoft Sentinel — via CEF connector

**Syslog configuration:**
```
Security Manager → Settings → Alerts → Syslog
  → Server: siem.company.com:514 (UDP/TCP)
  → Format: CEF (Common Event Format)
  → Severity filter: High and Critical only (or all, depending on SIEM capacity)
  → Test connection before production
```

## Common Issues and Troubleshooting

**Endpoint agent not reporting:**
1. Check agent service status: Services → Forcepoint DLP Endpoint (FP_DLPE)
2. Verify connectivity to FSM on port 443/8443
3. Check agent policy refresh: agent should poll FSM every 30 minutes
4. Review Windows Event Log → Application → Source: Forcepoint DLP

**High false positive rate on email DLP:**
1. Review incidents — identify which classifier is firing
2. Check if internal email between trusted domains is triggering (add domain to allowlist)
3. Review newsletter/automated email triggering credit card patterns (add sender to exclusion)
4. Adjust minimum count thresholds for bulk data classifiers

**Performance impact on endpoints:**
- Content classification is CPU-intensive; large files take longer
- Configure file size limit for classification (skip files >500MB)
- Exclude known-safe application directories from monitoring
- Use asynchronous inspection where real-time blocking not required

**Discovery scan not completing:**
1. Check FSM Discovery scan status — is it still running or stalled?
2. Verify credentials have read access to all scan targets
3. Check network connectivity from FSM/discovery agent to file server
4. Review scan log for access denied errors or timeout events