Advanced User Notifications

You can enable or disable email notifications that are sent to users when their captured DLP incidents or incident data are deleted from the gateway.

Notifications are especially important if incidents and data are deleted because of exceeding quota (may occur if the user's email storage exceeds the user-allowed limit), because:

  • DLP may delete UserCheck incidents and data for which the user expected to have more handling time.

  • DLP deletes the data; there is no way to undo this action.

On the other hand, if a user gets a notification that an incident expired because it wasn't handled in time, you can still retrieve the data of the incident (if needed). DLP deletes the data of expired incidents a number of days after the data expired.

You can configure, which DLP automatic actions fire the notifications.

To activate or de-activate user notifications of DLP deletion:

  1. Open the Database Tool (GuiDBEdit Tool) (see sk13009).

  2. In the top left pane, go to Table > Other > dlp_data_tbl.

  3. In the top right pane, click dlp_general_settings_object.

  4. In the bottom pane, in the Field Name column, scroll down to the notification object.

    You see different types of notifications (see the text in the Field description column).

  5. To enable a notification, set the value of its active attribute to true.

  6. Save the changes (File menu > Save All).

  7. Close the Database Tool (GuiDBEdit Tool).

  8. In SmartConsoleClosed Check Point GUI application used to manage a Check Point environment - configure Security Policies, configure devices, monitor products and events, install updates, and so on., install the policy.