IP-based policy management in Trellix DLP Network Appliances

Trellix DLP Network enables you to establish and enforce Web Protection policies based on individual IP addresses or IP ranges, offering an alternative to Active Directory or Lightweight Directory Access Protocol (LDAP) structures.

With IP-based policy management, DLP Administrators can configure specific policy inclusions and exceptions using IP addresses as conditions or exceptions in Web Protection rules. This facilitates tailored enforcement, such as blocking or allowing, for classified data transmitted across the web.

During event processing, Trellix DLP Network Prevent extracts IP address fields from the X-Client-IP ICAP headers supplied by the web proxy. The rule engine then checks these extracted IP addresses against defined network address parameters. For Trellix DLP Network Monitor, web protection rules are applied directly to HTTP traffic

Configure IP-based rules in Web Protection rules

Within a Web Protection rule condition, select an IP address or range from a predefined IP list. Based on the configured rule and the source or destination IP conditions, the rule engine allows or blocks incoming and outgoing web traffic.

Task

Configure IP address inclusions and exceptions

Configure IP address inclusions or exceptions in Trellix DLP Network Web Protection rules to manage policy enforcement based on network location.

1. Create or identify the required network IP address list:        

   1. In Trellix ePO, go to DLP Policy Manager.

   2. Go to Definitions → Network Address (IP Address).

   3. Select Add a new address. Enter the desired IP addresses to create a network address list.

   4. Select Save.

2. Create an IP-based rule:        

   1. Navigate to DLP Policy Manager → Rule Sets.

   2. Click Actions → New Rule → Web Protection to create a new rule.

   3. Enter the Rule Name, set State to Enabled, and select only Trellix Network DLP.

   4. Under the Conditions tab:        

      1. Select the needed classification.

      2. For all the IP addresses that have to be included, in the Source Network Addresses field, select the condition (for example, Is one of). Select the pre-added network IP address list from the Choose from existing values dialog box.

   5. Under the Exceptions tab:        

      1. Select Add Rule Exception.

      2. Set State to Enabled and select the desired classification and other values..

      3. For all the IP addresses that have to be excluded, in the Source Network Addresses field, set the condition (for example, Is one of). Select the pre-added network IP address list from the Choose from existing values dialog box.

   6. Under the Reactions tab, select the Action and select the desired check boxes in Report Incident.

   7. Select Save.

3. Apply policy changes:        

   1. Go to Menu → Systems → System Tree.

   2. Select the checkbox of one or more appliances that you want to assign the policy to.

   3. Click Wake Up Agents to push the policy to Trellix DLP endpoints immediately.
      The Wake Up Trellix Agent window opens.

   4. Next to Wake-up call type, select whether to send an Agent Wake-Up Call or a SuperAgent Wake-Up Call.

   5. Accept the default Randomization (0–60 minutes) or type a different value.
      If you type 0, agents respond immediately.

   6. Click OK to send the wake-up call to the endpoints.

Or, you can use the Break inheritance and assign the policy and settings below option to push the policy.

For information, see Assign and push a policy to a system.