Introduction

This guide describes FortiDLP Policy Templates v8.3.0.

To assist you in implementing policies at your organization, this guide details the functionality provided by each template, configurable parameters, and OS and FortiDLP Agent software requirements, if applicable. To contextualize detections, some templates are preconfigured with MITRE ATT&CK indicators that map high-risk activity to the security framework's tactics, techniques, and/or sub-techniques. You can also find information about supported incident clustering rules and predefined policy groups.

Some functionality requires further setup in addition to policy template configuration. Where applicable, this is indicated in this guide, and you will be directed to consult the relevant documentation for details and follow the necessary instructions.

Intended audience

This guide is oriented toward:

• IT security professionals responsible for integrating policies into their existing cybersecurity framework.
• system administrators tasked with configuring policies.

This guide is intended to accompany the FortiDLP Administration Guide.

Related documentation

• FortiDLP OOB Policy Assets Reference Guide
• FortiDLP Administration Guide
• FortiDLP Agent Deployment Guide
• FortiDLP Print Blocking Quick Start Guide

Terminology

Policy terms

Term	Definition
Policy	A rule specifying a user activity and a response if said activity occurs.
Policy group	A collection of policies to apply to one or more entities. FortiDLP lets you create custom policy groups from scratch to configure policies individually or use predefined policy groups to create policies in bulk.
Policy template	A form exposing a set of configurable parameters for creating a policy. FortiDLP provides standard policy templates that require partial configuration and out-of-box policy templates that require minimal configuration.
Policy asset	A predefined policy template parameter value that eases setup. FortiDLP lets you create custom policy assets from scratch and use out-of-box policy assets that require little or no configuration.
Incident clustering rule	A method for grouping detections together by a common property (such as a domain name, filename, and so on) or a common policy to form an incident. When this method is used, a single incident can encompass detections for one or multiple entities.
Incident sequence rule	A method for grouping detections together to form an incident when a chain of threat activities occurs during a given time window. When this method is used, a single incident will encompass detections for one entity only.