A DLP rule allows the admin to configure scan settings for Files and Emails.
File settings apply to objects scanned by any access method that supports DLP within the Netskope platform. Email objects presently only apply to emails scanned via the Email DLP (SMTP Proxy) access method.
File Scanning
DLP can scan either the Metadata or the Content of the file. See the Supported File Types for Detection page for more details.
For a file, the DLP rule can be configured to scan the Metadata or the Content of the file or a combination of the two. By default, the Metadata and Content options are selected as part of the rule. Admins can change the settings according to their use-case.
If the file being scanned contains structured data (e.g. Spreadsheets), the “Enable Record based scans” feature can be enabled to allow the scan context of the rule to be limited to each individual row or record within the file.
For example – A rule scanning an SSN keyword and an SSN number within the scope of Metadata and Content of a file will trigger a violation if the SSN keyword is found in the Metadata of the file and the SSN number is found in the Content of the file.
Email Scanning
DLP can scan the Header, Subject Line, Body, or Attachment of the email.
For an Email object received via the Email DLP (SMTP Proxy) access method, the DLP rule can be configured to scan the Header, Subject Line, Body or Attachment of the file. The admin can also choose to mix and match the options depending on their use-case. By default, the Subject line, Body and Attachment options are selected as part of the rule.