Symantec Dlp

---
name: symantec-dlp
description: "Expert agent for Symantec DLP (Broadcom). Covers Enforce Platform, Network Monitor/Prevent, Endpoint Discover/Prevent, Indexed Document Matching, Exact Data Matching, Vector Machine Learning, Cloud Detection Service, and CASB integration. WHEN: \"Symantec DLP\", \"Broadcom DLP\", \"Vontu\", \"Network Monitor\", \"Network Prevent\", \"Endpoint Prevent\", \"IDM\", \"VML\", \"Enforce Platform\", \"Cloud Detection Service\"."
license: MIT
---

# Symantec DLP (Broadcom)

This skill covers Symantec Data Loss Prevention (now Broadcom DLP), including the Enforce Platform, detection servers, network and endpoint enforcement, and advanced detection methods including IDM, EDM, VML, and OCR.

## How to Approach Tasks

1. **Identify the detection server role** — Network Monitor, Network Prevent (email or web), Endpoint Discover, Endpoint Prevent, Classification Server
2. **Identify the detection method** — IDM, EDM, VML, keyword/pattern, or OCR
3. **Classify the request:**
   - **Policy creation** — Apply Enforce Platform policy guidance
   - **Detection tuning** — Guide through detection method selection and configuration
   - **Deployment architecture** — Load architecture guidance
   - **Incident management** — Apply incident response workflow
   - **Cloud/CASB** — Apply Cloud Detection Service guidance

## Platform Architecture

### Core Components

```
Enforce Platform (Management Server)
├── Web-based management console
├── Policy authoring and distribution
├── Incident management database (Oracle or PostgreSQL)
├── Reporting and dashboards
└── Connects to all detection/enforcement servers

Detection Servers (enforce receives from these)
├── Network Monitor Server
│   └── Passive monitoring via SPAN/TAP — captures network traffic; no blocking
│
├── Network Prevent for Email
│   └── MTA integration (SMTP proxy) — inspect and block/redirect email
│
├── Network Prevent for Web
│   └── ICAP server integration with web proxy — inspect and block web uploads
│
├── Endpoint Server
│   └── Manages endpoint DLP agents; receives endpoint incidents
│
├── Classification Server
│   └── Provides classification services to other detection servers
│
└── Cloud Detection Service (SaaS)
    └── Cloud-based detection for Cloud Storage, SaaS apps (via CASB integration)
```

### Detection Methods

**Indexed Document Matching (IDM) — Document Fingerprinting**
- Fingerprints sensitive documents (PDFs, Word, Excel, emails, source code)
- Detects partial matches — even 10-15% of a sensitive document triggers
- Best for: protecting proprietary documents, financial reports, legal agreements, source code
- Process:
  ```
  1. Index sensitive documents into IDM index (Enforce → Policies → IDM Index)
  2. Choose file types and locations to index
  3. Set partial match threshold (typically 10-20%)
  4. Re-index regularly as documents change (scheduler available)
  5. Reference IDM index in DLP policy conditions
  ```

**Exact Data Matching (EDM) — Structured Data Fingerprinting**
- Fingerprints records from databases (CSV export)
- Only matches when actual record values appear in inspected content
- Best for: protecting employee PII, customer records, patient data
- Process:
  ```
  1. Export sensitive database to CSV (pipe-delimited)
  2. Create EDM profile in Enforce (define column mapping — first name, SSN, etc.)
  3. Index the CSV (creates hash index — plaintext not stored)
  4. Set field matching requirements (require 2+ fields from same row)
  5. Schedule regular re-indexing (data changes over time)
  ```

**Vector Machine Learning (VML) — Unstructured ML Classification**
- Trains a statistical model on document examples
- Classifies documents based on content semantics
- Best for: unstructured documents where regex/patterns aren't sufficient
- Process:
  ```
  1. Create VML profile in Enforce
  2. Upload positive examples (50+ documents of sensitive type)
  3. Upload negative examples (50+ non-sensitive similar documents)
  4. Train model (10-30 minutes)
  5. Review accuracy metrics; adjust training data if needed
  6. Deploy in simulation mode first; tune threshold
  ```

**Described Content Matching (DCM) — Pattern + Keyword**
- Regex patterns with keyword proximity and occurrence counting
- Best for: structured sensitive data (credit cards, SSN, passport numbers)
- Confidence levels: no native confidence scoring — use occurrence thresholds + keyword qualifiers

**Keyword Matching**
- Exact word or phrase matching
- Case-sensitive or insensitive options
- Best for: specific project names, classification labels, legal terms

**OCR (Image Analysis)**
- Extracts text from images before applying other detection methods
- Supported formats: JPEG, PNG, TIFF, BMP, GIF, PDF (image-based)
- Best for: screenshots, scanned documents, photo-based exfiltration
- Configure: Content Matching → Enable Image Analysis

### Network Monitor Server

Passive monitoring via network tap or SPAN port. Cannot block — detection and reporting only.

**What it captures:**
- SMTP (email) — outbound email bodies and attachments
- HTTP — web traffic (unencrypted; SSL inspection not available in Monitor)
- FTP — file transfers
- IM protocols — where cleartext (legacy protocols)

**SPAN port configuration:**
```
Network: Mirror all outbound traffic from core switch to Monitor server NIC
Monitor server: Set NIC to promiscuous mode
Enforce: Configure Network Monitor → specify capture NIC
Traffic copied (not diverted) — zero latency impact on production traffic
```

**Use case:** Baseline monitoring, compliance reporting, policy validation before deploying Prevent.

### Network Prevent for Email

MTA integration — acts as an SMTP proxy or journaling capture point.

**Deployment modes:**
```
Mode 1: Inline SMTP Proxy
  Mail client → [Network Prevent] → Corporate mail relay → Internet
  → Can block, redirect, quarantine
  → Latency: 0.5-2 seconds per message
  → Recommended for organizations that need to block email

Mode 2: MTA Journal (BCC copy)
  Corporate mail relay ──sends BCC──► [Network Prevent]
  → Monitor only (cannot block from journal copy)
  → Zero latency impact on mail flow
  → Recommended for initial deployment / audit phase

Mode 3: Integration with Exchange
  Exchange transport rule → Route to Network Prevent
  → Can block/hold messages in Exchange transport
  → Requires Exchange connector configuration
```

**Actions available on email:**
- Quarantine (hold for review by DLP admin)
- Block with sender notification
- Redirect to encrypted email gateway
- Add header (for downstream filtering)
- BCC to compliance mailbox

### Network Prevent for Web

ICAP server that integrates with HTTP proxy (Blue Coat, Squid, Zscaler, etc.).

**ICAP integration:**
```
Browser/client → Corporate proxy
                    │
                    ├── ICAP REQMOD: Send outgoing request to Prevent for inspection
                    │   → Prevent inspects HTTP POST body (file uploads)
                    │   → If violation: ICAP response = deny (proxy blocks upload)
                    │   → If clean: ICAP response = allow (proxy sends request to internet)
                    │
                    └── ICAP RESPMOD: Inspect incoming responses (for DLP on downloads)
                        → Less common for DLP; used for watermarking/rights management
```

**Limitations:**
- SSL inspection must be done by the proxy (Prevent sees cleartext after proxy decrypts)
- Supported file extraction: hundreds of file types (ZIP, Office, PDF, images)
- Large file handling: configurable size limit; files over limit can be passed or blocked by policy

### Endpoint DLP

**Agent components:**
- Windows agent: Symantec DLP Agent (kernel-level driver + user-mode service)
- macOS agent: Symantec DLP Agent for Mac (system extension)
- Agent communicates with Endpoint Server over HTTPS (port 443)

**Monitored activities:**
```
Endpoint Prevent (enforcement mode):
  → USB/removable media copy → Block, Notify, or Allow
  → Print → Block or Notify
  → Clipboard copy between applications → Block or Notify
  → Application file access → Block or Notify
  → Network share copy → Block or Notify
  → Browser upload → Block (requires browser extensions for some browsers)
  → Email client attachment → Block or Notify (Outlook, Lotus Notes)
  → FTP client transfer → Block or Notify
  → Bluetooth transfer → Block or Notify

Endpoint Discover (discovery mode):
  → Scan local hard drives for sensitive data
  → Report location of sensitive files
  → Optional: quarantine to encrypted location
```

**Endpoint offline mode:**
- Agent caches policy for offline enforcement
- Incidents queued locally when disconnected
- Stricter offline policy option (higher risk when off-network)

### Policy Configuration in Enforce

**Policy structure:**
```
Policy Group → Policy → Rules
                          │
                          ├── Detection: (conditions)
                          │   ├── Content Matches Keyword: [list of keywords]
                          │   ├── Content Matches Data Identifier: [SSN, Credit Card, etc.]
                          │   ├── Sender/User Matches Pattern: [email domain, AD group]
                          │   ├── Recipient Matches Pattern: [external domains]
                          │   └── Protocol: [email, HTTP, endpoint]
                          │
                          └── Response: (actions)
                              ├── Notify (email alert to DLP team)
                              ├── Severity level: High / Medium / Low / Info
                              ├── Block → [Block message, Block with justification override]
                              ├── Quarantine
                              └── Automated response rule (redirect, encrypt, etc.)
```

**Creating a credit card policy:**
```
Policy Group: Financial Data Protection
Policy: Credit Card Protection

Rule 1: Credit Card Transmission
  Detection:
    → Content Matches Data Identifier: Credit Card Number [occurrence: 1+]
    → Recipient/Destination: External (not *.company.com)
  Response:
    → Severity: High
    → Notify: DLP Team distribution list
    → Block (for Network Prevent channels)
    → Block with Justification (for Endpoint channels)

Rule 2: Bulk Credit Card Data
  Detection:
    → Content Matches Data Identifier: Credit Card Number [occurrence: 10+]
    → Any destination (including internal)
  Response:
    → Severity: Critical
    → Notify: DLP Team + CISO
    → Block all channels
```

### Cloud Detection Service (CDS)

SaaS-delivered detection service that extends Symantec DLP to cloud workloads.

**CDS capabilities:**
- Inspects content in cloud storage via API (Box, Google Drive, Dropbox)
- Integrates with Symantec Web Security Service (WSS) for inline inspection
- Uses same Enforce policies — no separate policy authoring for cloud
- Supports IDM, EDM, and DCM detection methods in cloud context

**Integration with CASB:**
```
Cloud Detection Service
├── API-based cloud scanning (out-of-band):
│   → Connects to cloud storage APIs
│   → Scans files stored in cloud; reports violations to Enforce
│   → Actions: quarantine, delete, apply rights management, notify
│
└── Inline inspection via WSS or CASB:
    → User traffic proxied through WSS
    → Uploads/downloads inspected before reaching cloud
    → Block or allow based on DLP policy
```

### Incident Management

**Incident lifecycle:**
```
Detection event → Incident created in Enforce
     │
     ├── Severity assigned (High/Medium/Low/Info) based on policy
     ├── Assigned to incident owner (policy owner or queue)
     │
     ├── Workflow states: New → Assigned → In Progress → Resolved
     │   └── Sub-statuses: Investigating / Escalated / False Positive / Confirmed
     │
     ├── Evidence stored:
     │   ├── Matched content (snippet or full content, configurable)
     │   ├── File metadata (filename, size, type)
     │   ├── User info (username, machine name, IP)
     │   └── Channel info (email recipient, URL, device type)
     │
     └── Response actions:
         ├── Add notes / audit trail
         ├── Attribute to data owner for remediation
         ├── Escalate to HR/Legal
         ├── Export for legal hold
         └── Close with reason (False Positive / Business Use / Risk Accepted)
```

**Incident report customization:**
- Enforce → Policies → Response Rules → Custom Notification
- Variable substitution: `%POLICY%`, `%SEVERITY%`, `%USER%`, `%CONTENT_DETAIL%`
- HTML-formatted notifications for branded email alerts

### Reporting and Dashboards

**Standard reports:**
- Incident summary (by severity, policy, time period)
- Top violating users
- Top policies triggered
- Trend analysis (increasing/decreasing violation rates)
- SLA compliance (incident response time against target)

**Custom reports:**
- Enforce → System → Reports → New Report
- Supports filters by: policy, severity, protocol, user, status, date range
- Export formats: PDF, CSV, XML

**SIEM integration:**
- Syslog: CEF format → Splunk, QRadar, ArcSight
- REST API: pull incident data via Enforce REST API
- Email: automated report delivery

## Deployment Best Practices

**Initial deployment sequence:**
```
Phase 1: Discover
  → Deploy in monitor/audit mode only
  → Enable Network Monitor (passive SPAN)
  → Run Endpoint Discover on file shares and endpoints
  → Build baseline of where sensitive data lives

Phase 2: Understand
  → Review 2-4 weeks of monitor data
  → Identify top violation patterns
  → Tune classifiers — identify FP sources
  → Prioritize enforcement by risk

Phase 3: Enforce
  → Enable Network Prevent in inline mode (email first, then web)
  → Enable Endpoint Prevent on pilot group
  → Enable user notifications + justification override
  → Expand to full population in waves

Phase 4: Optimize
  → Tune based on incident review
  → Add IDM/EDM for high-value data sources
  → Enable advanced features (OCR, VML)
  → Integrate with SIEM and SOAR
```

**Performance sizing:**
- Network Monitor/Prevent: 1 server per ~1 Gbps of inspected traffic
- Enforce Platform: Oracle/PostgreSQL sizing based on incident volume
- Endpoint Server: 1 server per ~5,000 endpoints (varies by incident volume)
- IDM indexing: SSD recommended; index size ~2% of indexed document corpus

## Common Issues and Troubleshooting

**Endpoint agent communication failure:**
1. Check port 443 connectivity: endpoint → Endpoint Server
2. Verify certificate trust (Enforce uses self-signed cert by default)
3. Check agent service: `net start` or services.msc → Symantec DLP Agent
4. Review agent log: `C:\ProgramData\Symantec\DLP\Logs\`

**IDM not detecting documents:**
1. Verify IDM index built successfully (Enforce → Policies → IDM → View status)
2. Check file type is supported for IDM indexing
3. Verify partial match threshold isn't set too high (try 10%)
4. Confirm test document has significant overlap with indexed source

**High incident volume overwhelming team:**
1. Review top 5 policies by incident count — likely tuning opportunities
2. Increase minimum occurrence thresholds (3+ credit cards vs. 1)
3. Add trusted domain exclusions (internal systems, known-safe senders)
4. Enable auto-close for low-severity with specific patterns (internal-only, known business processes)
5. Consider incident routing to business unit owners (not all to central DLP team)