Assignments

Provides support for prioritized list of Smartkeys.

Name

There are three types of assignments i.e., Discovery, Decrypt, and Encrypt.

• Discovery – All files are scanned, and action is taken only on those files which meet the defined criteria.
• Decrypt – All files that are found in defined location will be decrypted.
• Encrypt – All files that are found in defined location(s) will be encrypted. This is the default option.

This field displays the list of Active Directory users and groups. To search users, you can make use of Advanced Definitions feature.

*Note: A user can be defined in more than one assignment, the first one in the assignment processing list controls the action on a location(s) of a device.

This field contains the exact path of the folder where the files are kept for discovery, encryption, or decryption. You can use the Universal Naming Convention (UNC) path or can map a network drive to define this path.

If path does not exist on the specified device, then PK Protect Agent will create a path. If path is invalid, no assignment will be created. This path is relative to PK Protect Agent, if mounted drive exists on the remote device, it can be referenced through drive letter.

You can use variables for referencing user or device specific locations. The format for referencing a location is ‘${Variable}’.

*Note: if many users in the scope of the assignment can see the same remote drive, issues can arrive. When using remote path, scope must be locked down to one device.

This option is a secondary scan which runs to ensure that all the files are processed. Sometimes there is a possibility that system under extremely high load will not expose the correct file system event to PK Protect. Due to this reason, the file will not get processed.

The time interval specifies how often a secondary scan should run. The default setting is 84, 600 second i.e., Day.

*Note: On Solaris, AIX and HP-UX systems, there are no system event notifications for PK Protect.

The assignment path communicates its status to the PK Endpoint Manager (PEM), which in turn generates a report whether the PK Protect Agent has received latest policy change or not.

If you want to provide more details on specific file type on when the discovery task is triggered, opt for this option. This option is visible when Windows is opted as a Platform.

Supported file types are: docx, xls, xlsx, ppt, pptx, vsd, one.

Selecting this option will allow agents to discover the sensitive information in the supported image file types. 

This option is visible on screen when Encrypt is selected in the Mode drop-down. Following settings are available:

• Report Successful Encryption - Select this option, if you want to report any successful encryption events to PEM.
• Report Encryption Failures – Select this option, if you want to report any encryption failure events to PEM.

This option is visible on screen when Decrypt is selected in the Mode drop-down. Following settings are available:

• Report Successful Decryptions - Select this option if you want to report any successful decryption events to PEM.
• Report Decryption Failures – Select this option if you want to report any decryption failure events to PEM.

Select this option if you want to report any successful re-encryption events to PEM Administrator. 

E.g., If a file is within an archive i.e., at the top-level archive. The depth level is defined as 2.

If checked, the underlying file from an archive is remediated, extracted on disk and the original zip file is deleted.

If unchecked, the file remains intact and is remediated.

If checked, the agent will scan encrypted files within the archive. With this box checked and there is a remediation action that modifies the file, the file will remain decrypted unless the 'encrypt' action is selected as part of the remediation action.

This field lists down all the filter bundles defined in the Discovery screen. These bundles are used for scanning the sensitive data within a document or file.

You can make use of Advanced Definition feature for searching filter bundles.

This field lists down all the MIP labels defined in the MIP screen. This feature discovers a specific MIP label based on the selection.

This drop-down displays the list of all the file filters defined in the File Filters screen that can be accessed via Advanced > File Filters.

This feature allows you to scan only those file extensions and paths which are specified in the filter. To know more, refer File Filter.

This field displays list of all remediation actions that can be applied on the filter bundle. The order of remediation action is important as PK Protect Agent processes the remediation actions list from top to down.

E.g., if an assignment has two remediation actions, the first remediation action at the top looks for ‘Secret’ and has a remediation action that will encrypt and move the file. The second remediation action looks for, ‘Secret’ + ‘Sensitive’, and takes a remediation action by deleting the files.

If agent finds ‘Secret’, it will only apply the first remediation action i.e, encrypting and moving the file. If agent finds ‘Sensitive’, it will only apply the second remediation action i.e., deleting the file.

This field displays the name of the assignment. 

It displays the type of assignment i.e., Discovery, Decrypt or Encrypt.