DLP profiles in the GUI

Search documents and hardware ...

Home FortiProxy 7.4.0 Release Notes

This information is also available in the FortiProxy 7.4.0 Administration Guide:

Basic DLP settings

The DLP profile is available in the GUI on the Security Profiles > Data Leak Prevention page. Users can configure DLP settings within the Profiles, Sensors, and Dictionaries tabs. DLP profiles cannot be added to SSH tunnel policies.

Example 1

This configuration will block HTTPS upload traffic that includes credit card information. The pre-defined data type for credit card is used in the dictionary.

To block HTTPS upload traffic that includes credit card information:

Configure the DLP dictionary:
1. Go to Security Profiles > Data Leak Prevention, select the Dictionaries tab, and click Create New.
2. Enter a name (dic-case1).
3. In the Dictionary Entries section, click Create New.
4. Set the Type to credit-card and click OK.
5. Click OK to save the dictionary.
Configure the DLP sensor:
1. Go to Security Profiles > Data Leak Prevention, select the Sensors tab, and click Create New.
2. Enter a name (sensor-case1).
3. In the Sensor Entries section, click Create New.
4. Set the Dictionary to dic-case1 and click OK.
5. Click OK to save the sensor.

Configure the DLP profile:

Go to Security Profiles > Data Leak Prevention, select the Profiles tab, and click Create New.
Enter a name (profile-case1).
In the Rules section, click Create New.

Configure the following settings:

Name	1
Sensors	sensor-case1
Severity	Medium
Action	Block
Type	File
File type	builtin-patterns
Protocol	HTTP-POST, HTTP-GET

Click OK.
Click OK to save the profile.

Add the DLP profile to a policy:
1. Go to Policy & Objects > Policy and click Create New.
2. Set the Type to any except SSH Tunnel which does not support DLP.
3. In the Security Profiles section, enable DLP Profile and select profile-case1.
4. Configure the other settings as needed.
5. Click OK.
  
  When a credit card is included in HTTP POST traffic, the file is blocked and a DLP log is generated.

Sample log

1: date=2022-10-26 time=11:25:01 eventtime=1666808700281057923 tz="-0700" logid="0954024576" type="utm" subtype="dlp" eventtype="dlp" level="warning" vd="vdom1" filteridx=1 filtername="1" dlpextra="builtin-patterns;sensor-case1" filtertype="sensor" filtercat="file" severity="medium" policyid=1 poluuid="891a526a-51cd-51ed-577a-6505bec88af9" policytype="policy" sessionid=3905 epoch=2143297701 eventid=0 srcip=10.1.100.11 srcport=40370 srccountry="Reserved" srcintf="port2" srcintfrole="undefined" srcuuid="502d2c8e-51cd-51ed-a24e-a091f4ff6fed" dstip=172.16.200.55 dstport=443 dstcountry="Reserved" dstintf="port1" dstintfrole="undefined" dstuuid="502d2c8e-51cd-51ed-a24e-a091f4ff6fed" proto=6 service="HTTPS" filetype="msoffice" direction="outgoing" action="block" hostname="172.16.200.55" url="https://172.16.200.55/cgi-bin/upload.pl" agent="curl/7.58.0" httpmethod="POST" filename="credit_card.doc" filesize=22016 profile="profile-case1"

Example 2

This configuration will log FTP upload traffic with the following patterns:

keyword = demo
regex = demo(regex){1,5}
hex = e6b58be8af95

The dictionary entries have repeat match enabled. The DLP sensor is set so this is repeated five times.

To log FTP upload traffic that has specific keyword, regex, and hex patterns repeated for five times:

Configure the DLP dictionary with three entries:
1. Go to Security Profiles > Data Leak Prevention, select the Dictionaries tab, and click Create New.
2. Enter a name (dic-case2).
3. In the Dictionary Entries section, click Create New.
4. Set the Type to keyword and the Pattern to demo.
5. Enable Repeats and click OK.
6. Repeat these steps to add dictionary entries for the following (with Repeats enabled):
  1. Set the Type to regex and the Pattern to demo(regex){1,5}.
  2. Set the Type to hex and the Pattern to e6b58be8af95.
7. Click OK to save the dictionary.
Configure the DLP sensor:
1. Go to Security Profiles > Data Leak Prevention, select the Sensors tab, and click Create New.
2. Enter a name (sensor-case2).
3. In the Sensor Entries section, click Create New.
4. Set the Dictionary to dic-case2, set the Count to 5, and click OK.
5. Click OK to save the sensor.

Configure the DLP profile:

Go to Security Profiles > Data Leak Prevention, select the Profiles tab, and click Create New.
Enter a name (profile-case2).
In the Rules section, click Create New.

Configure the following settings:

Name	1
Sensors	sensor-case2
Severity	Medium
Action	Block
Type	File
File type	builtin-patterns
Protocol	FTP

Click OK.
Click OK to save the profile.

Add the DLP profile to a policy:
1. Go to Policy & Objects > Policy and click Create New.
2. Set the Type to any except SSH Tunnel which does not support DLP.
3. In the Security Profiles section, enable DLP Profile and select profile-case2.
4. Configure the other settings as needed.
5. Click OK.
Upload a Word document that contains "demo, demo, demo, demoregexregex," using FTP.

A DLP log is generated after the FTP traffic passes.

Sample log

1: date=2022-10-26 time=12:37:57 eventtime=1666813077679725858 tz="-0700" logid="0954024576" type="utm" subtype="dlp" eventtype="dlp" level="warning" vd="vdom1" filteridx=1 filtername="1" dlpextra="builtin-patterns;sensor-case2" filtertype="sensor" filtercat="file" severity="medium" policyid=1 poluuid="891a526a-51cd-51ed-577a-6505bec88af9" policytype="policy" sessionid=6267 epoch=909159520 eventid=0 srcip=10.1.100.11 srcport=52858 srccountry="Reserved" srcintf="port2" srcintfrole="undefined" srcuuid="502d2c8e-51cd-51ed-a24e-a091f4ff6fed" dstip=172.16.200.55 dstport=43411 dstcountry="Reserved" dstintf="port1" dstintfrole="undefined" dstuuid="502d2c8e-51cd-51ed-a24e-a091f4ff6fed" proto=6 service="FTP" filetype="msoffice" direction="outgoing" action="block" filename="realizedDoc.doc" filesize=26624 profile="profile-case2"