Trellix DLP Endpoint for Windows integration with Seclore Digital Rights Management

Trellix DLP Endpoint for Windows integrates with Seclore Digital Rights Management (DRM) version 3.22.5.0 through the Trellix ePO console to deliver data protection across Windows endpoints and external sharing. The integration applies Seclore policies to a document on a Windows endpoint where classified data is identified during an Endpoint File system discovery scan. Seclore offers data protection by restricting unauthorized user actions, such as viewing, editing, printing and screen sharing.

By applying continuous document-level access controls, administrators can collaborate safely with third-party vendors and partners while maintaining strict data compliance after files leave the network.

Benefits

• Automated discovery protection: Applies security policies automatically after a local file system discovery scan identifies classified data.

• Granular access control: Pre-defines specific document permissions to restrict actions to view, edit, or print.

• Secure external collaboration: Shares documents safely with third parties, vendors, and partners.

• Continuous endpoint coverage: Seclore applies policies on Discovery to newly created or unscanned documents.

Protect data using Seclore DRM

This section outlines how to integrate Seclore DRM with Trellix DLP Endpoint to automatically apply Seclore protection to classified files identified by Endpoint Discovery scan on Windows Endpoints.

Prerequisites

• Install Seclore DRM client version 3.22.5.0 on the endpoint. Complete all required configurations for Seclore.

• Before setting up the rule for Seclore in Trellix ePO, gather the required parameters:

  • Classification ID: In the Seclore portal, select Classification Policies to get the ID for your target label (for example, 10008 for Confidential). Pass this ID using the -classification argument.

  • Policy ID: In the Seclore portal, select List Policies to get the List ID (for example, 100501). Pass this ID using the -listId argument.

Task

To enable and configure the Seclore policy, follow these steps in Trellix ePO:

1. Enable Seclore Rights Management in the Windows Client Configuration page.

   1. Navigate to Policy Catalog → Data Loss Prevention <version> → Windows Client Configuration.

   2. Create or edit a policy. In the policy page, navigate to Operational Mode and Module → Digital Rights Management Modules and select Seclore Rights Management.

   3. Click Apply Policy.

2. Create a Discovery Rule:

   1. Navigate to DLP Policy Manager → DLP Rule Set → Discovery.

   2. Click Action → New Endpoint Discovery Rule → Local File System to create a new Endpoint Discovery rule.

3. Configure the Conditions and select the Classification.

4. Configure the Reaction:

   1. Select Action: Set to Seclore Protect.

   2. Executable Name: Verify it is set as SecloreActionDispatcher.exe (do not alter this unless the executable has changed from Seclore).

   3. Arguments: Enter the desired argument configuration depending on the protection scenario.

Example: -type "self" -classification "1"

For more information about arguments, see the Arguments Reference table.

Note: If you use -type "policy" in the arguments string, you must also specify a valid -listId. Omitting -listId causes an invalid parameter failure (Error Code -10609021).

5. Report Incident: Select options for reporting incidents.

6. Click Save.

7. Apply policy.

Seclore integration scope

Review the integration scope details and limitations before deployment.

Command-Line Argument Reference

The following table lists the case-sensitive command-line arguments for Seclore protection scenarios.

Configuration examples

• -type "self" -classification "1"

• -type "policy" -listId "1" -classification "1"