Optimize Data Classification at Rest With These Easy Steps

• Learn to configure Symantec High Speed Discovery to effectively classify documents and sensitive labels using MPIP, previously known as MIP.
• Set up and run Symantec DLP High Speed File System scans with confidence, letting it classify data at rest while you focus on more strategic work.
• Discover how to review and analyze classification results within Symantec DLP.

In today’s data-driven world, properly classifying sensitive information is more important than ever. Symantec High Speed Discovery empowers organizations to classify data at rest using Microsoft Purview Information Protection (MPIP)*, offering better security and compliance for your organization.

This guide will walk you through the process step by step, so you can confidently take advantage of its capabilities and optimize your security. Follow these simple steps and, if needed, refer to the documentation for further details. 

*Note, the documentation may refer to MIP (the earlier name of MPIP) to reflect the options presented within the Symantec DLP product interface.

Prerequisites

Before you start, make sure you meet the following requirements:

1. Symantec Data Loss Prevention (DLP) Environment: An active Symantec DLP Enforce console along with Discover Cluster setup. Get more information on Network Discover Cluster installation here.
2. MIP Credential Profile Configuration: A Microsoft Information Protection Classification Credential Profile configured, with classification labels synced in Symantec DLP. To learn more about managing Microsoft Information Protection Classification Credential Profile on Symantec DLP Enforce console, check out these tips.

Step-by-Step Guide

Step 1: Create an Automated Response Rule with Network Protect Action “Apply MIP Classification”

1. Navigate to Manage > Policies > Response Rules in the DLP Enforce console.
2. Click Add Response Rule.
3. Select Automated Response Rule and name it (e.g., “MIP Classification Rule”).
4. Choose Network Protect Action and set the action to “Apply MIP Classification”.
5. Click Add Action.
6. Select the Label to apply. Optionally you can select Sub-label also.
7. Deselect Exclude generating incident check box, to generate the incident. This will result in generating an incident for each file that is classified with this response rule. This may result in incident overload in the Enforce Server database. Therefore it is advised to seek caution and generate incidents while classifying files only if necessary.
8. Save the rule.

Step 2: Create a Policy with the “Apply MIP Classification” Automated Response Rule

1. Go to Manage > Policies > Policy List in the DLP Enforce console.
2. Click New Policy and configure it for the Name, Detection rules, etc. as per your requirements.
3. In the Response tab, select the ‘MIP Classification Rule’ created in Step 1.
4. Click on Add Response Rule to link the response rule with the policy.
5. Save the policy.

For more information on how to manage and add policies, refer to this guide.

Step 3: Configure the High Speed Discovery File System Scan Target

1. Navigate to Manage > Discover Scanning > Discover Targets.
2. Click Add New Target and Select the File System - High Speed Discover under Server option.
3. In the File System - High Speed Discover scan target configuration, provide details such as Name, Policy Group, Network Discover Cluster, Content Roots, etc. as necessary.
4. Under the Protect tab, enable the protect action “Apply MIP Classification”.
5. Save the target configuration.

If you need further help configuring High Speed Discovery scan target, check out Configuring The File System.

Step 4: Run the High Speed Discovery File System Scan Target

1. Navigate to Manage > Discover Scanning > Discover Targets.
2. Select the File System - High Speed Discover scan target defined in Step 3 and click on Start Scan under Scanning option dropdown to trigger the scan.
3. Monitor scan progress in the Enforce Console.

Step 5: View Classification Details

1. After the scan completes, navigate to Manage > Discover Scanning > Scan History.
2. A list of completed scan results will be displayed for each Network Discover target.
3. Click on the Scan Status\ for the scan triggered in Step 4.
4. Click on the MIP Classification Statistics tab to review classification statistics along with the MIP sensitivity label distribution summary.
5. Click on the Download Full Classification Report link to download the detailed classification report CSV file.

More information is also available on the scan details at our DLP’s Help Center.

Step 6: Review Incidents with “MIP Applied Label”

1. After the scan completes, navigate to Incidents > Discover.
2. A list of Discover incidents will be displayed.
3. Click on one of the Incident ID and under the Incident Details section verify the MIP label applied for the scanned files.
4. If required, fine-tune the incident list by filtering incidents by MIP Classification Applied sensitivity label names. 

You can also find detailed reports and other resources at our help center for viewing, managing and reporting incidents.

How to use REST APIs for Classification and Scan Details

Symantec DLP enhances efficiency with REST APIs designed to streamline access to classification and scan details. These powerful APIs allow administrators to programmatically retrieve data on MIP-applied labels details, scan results and incident details, while simultaneously supporting automation and integration with external systems. These key API endpoints include:

• Incident Management API: Seamlessly retrieve incidents and associated incident details, including MIP classification labels.
• Storage DLP API: Generate comprehensive High Speed Discovery Discover target scan specific reports, covering everything from statistics and errors to activities and MIP classification breakdowns.

For a deeper look at authentication, endpoints, request/response formats and code samples, explore our Symantec DLP REST API documentation—and get the most out of your APIs.  

Some key benefits of integrating MIP with Symantec DLP are:

• Seamless Integration:
  Symantec DLP High-Speed Discovery integrates effortlessly with Microsoft Information Protection (MIP), enabling quick deployment with minimal disruption to existing workflows. With a simpler setup, organizations can focus on their core operations.
• Enhanced Classification Accuracy:
  By integrating with MIP, Symantec DLP improves classification accuracy, detecting deeply embedded sensitive data and applying MIP labels based on DLP policy violations, including document encryption.
• Scalability and Flexibility:
  With scan speeds of up to 1TB per hour, Symantec DLP High-Speed Discovery scales to easily meet the demands of growing data volumes for efficiency that doesn’t compromise performance.
• MIP Sensitivity Label Based Detection:
  Symantec DLP detects MIP sensitivity labels applied through High-Speed Discovery, automating label application and enabling inspection of MIP-encrypted files across DLP channels.
• Comprehensive Data Visibility:
  Offering even deeper visibility into sensitive data stored on network shares, High-Speed Network Discovery provides key insights into data location and usage for better risk management.
• Streamlined Compliance:
  Easily meet regulatory requirements like GDPR and HIPAA by ensuring sensitive data is accurately classified and protected.

Streamline compliance while effectively classifying your data

Now that you’re equipped to configure and run Symantec High Speed Discovery scan target to classify, you can classify your organization’s on-premises data at rest using MIP labels for enhanced accuracy and security. This powerful combination will help you simplify compliance with scalable solutions that adapt to your needs. Take your data security strategy to the next level by integrating MPIP’s powerful capabilities into your DLP workflows. For more details, visit the official Symantec DLP Help Center.