Managing Microsoft Sensitivity Labels for DLP

Harmony Endpoint allows you to integrate Sensitivity labels from Microsoft Purview Information Protection into your DLP system, providing an additional layer of data protection based on predefined sensitivity classifications.

Step 1 - Copy the Microsoft Sensitivity label names and their UUIDs from Microsoft Purview

Step 2 - Creating Microsoft Sensitivity Labels in Harmony Endpoint

1. Log in to Infinity Portal and access the Harmony Endpoint Administrator Portal:

2. Go to Policy > Data Loss Prevention and click DLP Data Type Manager.

3. Click Manage Labels.

   

   The Manage Sensitivity Labels Dashboard window appears.

   

4. Click New.

   

5. In the Name field, enter a name for the label. For example, MIP_EXAMPLE.

6. In the UUID field, enter the label UUID. For more information, see Step 1 - Copy the Microsoft Sensitivity label names and their UUIDs from Microsoft Purview.

7. Click Add.

8. Click OK.

   Note - The newly created label is now listed in Sensitivity Labels under Data Type Name section. It also shows the label details: Date modified Description Tags - Shows tags assigned, if any, for further categorization Where used - Shows the DLP rule name that uses this label to enforce protection. Groups - Shows if the label is part of any group. You can use Tags and Groups to better organize and manage the sensitivity labels.

9. To edit a label, select the label you want to edit, click Edit, update the field and then click Apply.

   

    

10. To delete a label, select the label you want to delete, click Delete and then click Delete Data Type.

    

11. Click Save.

    

12. Click Confirm.

Step 3 - Assign Sensitivity Labels to DLP Rules

After creating Sensitivity labels in Harmony Endpoint, you must assign them to the DLP rules to enforce data protection based on these sensitivity labels.

To assign sensitivity labels to a DLP rules, see Creating a DLP Rule and Associating with an Event.

Creating a DLP Rule and Associating with an Event

1. Go to Policy > Data Loss Prevention.

2. Add a rule:

   1. Select a rule.

   2. Click Clone and click Clone Above or Clone Below.

      

      Note - If you have selected the default rule, select Clone Above.

      The Clone Rule window appears.

      

   3. In the Name field, enter a rule name.

   4. From the Applied to list, select a device(s) to which you want to apply the rule.

   5. Click OK.

3. To enable the Gen AI protection, see Enabling GenAI Protect.

4. Click one of these tabs:

   • Outbound events - Outbound data refers to transferring content to external resources.

     Examples:

     • Uploading file to a file sharing website.

     • Entering text in a text box of an external resource, such as ChatGPT.

     • Pasting text in a text box of an external resource, such as ChatGPT.

     Note - Enforcement of DLP for Paste and Text Control events is only supported for Generative AI sites.

   • Inbound events - Inbound data refers to downloading data and sharing content within internal corporate resources.

     Example - Downloading file from a file sharing website.

   

5. Click Add.

   The Data Protection - New Event window appears.

   

6. By default, the event is enabled. To disable, turn off the Status toggle button.

7. From the Event type list, select one of these:

   Event Type	Applies to	Description
   File upload	Outbound events	To apply the DLP rule when you upload a file to an external resource.
   Text control	Outbound events	To apply the DLP rule when you type text in an external resource text box. For example, in ChatGPT.
   Paste	Outbound events	To apply the DLP rule when you paste content into an external resource. For example, ChatGPT.
   File download	Inbound events	To apply the DLP rule when you download a file from an internal resource.
   Copy	Inbound events	To apply the DLP rule when you copy content from an internal resource.

   Note - Enforcement of DLP for Paste and Text Control events is only supported for Generative AI sites.

8. From the Destination type list, select one of these type to which you want to apply the rule:

   Destination type	Applies to	Description
   All	File upload	N/A
   Url	File upload File download Copy	In the URL field, enter the web addresses to which you want to apply the rule.
   Application	Text control Paste	In the Applications field, select the application(s) to which you want to apply the rule.
   Domain	File upload File download Copy	In the Domain field, enter the domain to which you want to apply the rule.
   Category	File upload Text control Paste	From the Categories & sub categories list, select one or more categories.

   Notes: In Inbound events, you can only choose a URL or Domain. In Inbound events, if a source is added for DLP scanning, files downloaded from that source are not scanned by Threat Emulation.

9. From the Action list, select one of these:

   • Detect - Performs the DLP scan but does not block the data.

   • Prevent - Performs the DLP scan and prevents data transfer if it finds a match to a data type.

   • Allow - Acts as exclusions, allowing data transfer in certain events.

   • Block - Blocks the data without the DLP scan.

   • Ask - Asks the user to provide justification before allowing data transfer based on the DLP scan results.

10. To associate data types with an event, in the Data types section, click and select the data type or a group.

    Note - This step is applicable only if the Action is Ask, Detect or Prevent.

11. Click Save.

    The events are displayed in the Outbound events and Inbound events columns in the DLP rule.

    

12. To delete an event, select the event that you want to delete and click Delete.

13. To edit an event, select the event that you want to edit, click Edit, make the required changes and click OK.

14. To disable all events, turn off the Disable all toggle button.

    

15. Click Save & Install.

    The Install Policy window appears.

    

16. Click Install.

Rule Configuration Logic

The rule configuration logic offers a systematic method for applying policy rules to events. The system prioritizes the most specific events and progresses through these levels of specificity:

1. URL

2. Application

3. Domain

4. Category

5. All

Note - The Paste and Text control events have access only to the Application and Category levels.

Scenarios

When multiple events are relevant for the same incident, the events with the strict action is selected.

Context Objects

Context objects are AI-based advanced data models designed to improve the detection of sensitive information through contextual analysis and classification. They are used exclusively for AI applications, as well as for monitoring Text Control and Paste events.

Enabling GenAI Protect

The Data Loss Prevention policy allows the administrators to enable the Gen AI Protect feature on the endpoints. It monitors the use of various generative AI applications in the endpoints. It detects and prevents the sharing of potential confidential information in the prompts to any generative AI applications by the Endpoint Security Clients.

Note - GenAI Protect feature is supported only for the Infinity Portal tenants residing in the EU and US regions.

To enable GenAI Protect and view the Dashboard:

1. Access the Harmony Endpoint Administrator Portal.

2. From the left navigation panel, click Policy > Data Loss Prevention.

3. Create a Data Loss Prevention policy with Outbound events for Text Control or Paste actions with these options:

   1. In the Categories & Subcategories list, select Artificial Intelligence (AI).

   2. In the Action list, select the action required.

      • Prevent

      • Detect

      • Allow

      • Ask

      • Block

   3. In Data types, select the data types required for the policy.

   4. Click Save.

4. Go to Settings tab and select the Enable GenAI protect checkbox.

   

5. Click Save & Install.

6. To view the dashboard, from the top right corner of the page, click GenAI Protect Dashboard.

   

   The system redirects you to the Harmony SaaS Administrator Portal and shows the GenAI Protect Dashboard.

   Notes: If you access the GenAI Protect dashboard for the first time, the system might request to activate Harmony SaaS. Click Start trial. Though GenAI Protect is visible in the Harmony SaaS Administrator Portal, you do not need additional license to use GenAI Protect and it is a part of Harmony Endpoint license that you have. Till the time, the secure browser extension detects events that match the DLP policy rules of GenAI Protect, the system shows the Welcome page. Once the secure browser extension detects events that match the DLP policy rules of GenAI Protect, the system shows events in the GenAI Protect Dashboard.

For information about how to use GenAI Protect dashboard, see Harmony SaaS Administration Guide