DLP examples

This topic includes examples that incorporate several DLP settings:

• Example 1: Block HTTPS upload traffic that includes credit card information

• Example 2: Log FTP upload traffic with a specific pattern

• Example 3: Block HTTPS downloads of EXE files and log HTTPS downloads of files larger than 500 KB

• Example 4: Block HTTPS upload traffic that includes Visa or Mastercard information using evaluation via logical expression

• Example 5: Block HTTPS upload traffic that includes a MIP label

Example 1: Block HTTPS upload traffic that includes credit card information

This configuration will block HTTPS upload traffic that includes credit card information. The pre-defined data type for credit card is used in the dictionary.

To block HTTPS upload traffic that includes credit card information in the GUI:

1. Configure the DLP dictionary:

   1. Go to Security Profiles > Data Loss Prevention, select the Dictionaries tab, and click Create New.

   2. Enter a name (dic-case1).

   3. In the Dictionary Entries section, click Create New.

   4. Set the Type to credit-card and click OK.

      

   5. Click OK to save the dictionary.

2. Configure the DLP sensor:

   1. Go to Security Profiles > Data Loss Prevention, select the Sensors tab, and click Create New.

   2. Enter a name (sensor-case1).

   3. In the Sensor Entries section, click Create New.

   4. Set the Dictionary to dic-case1 and click OK.

      

   5. Click OK to save the sensor.

3. Configure the DLP profile:

   1. Go to Security Profiles > Data Loss Prevention, select the Profiles tab, and click Create New.

   2. Enter a name (profile-case1).

   3. In the Rules section, click Create New.

   4. Configure the following settings:

      Name	1
      Sensors	sensor-case1
      Severity	Medium
      Action	Block
      Type	File
      File type	builtin-patterns
      Protocol	HTTP-POST, HTTP-GET

      

   5. Click OK.

   6. Click OK to save the profile.

4. Add the DLP profile to a firewall policy:

   1. Go to Policy & Objects > Firewall Policy and click Create New.

   2. Set the Inspection Mode to Proxy-based.

   3. In the Security Profiles section, enable DLP Profile and select profile-case1.

   4. Configure the other settings as needed.

   5. Click OK.

      When a credit card is included in HTTP POST traffic, the file is blocked and a DLP log is generated.

To block HTTPS upload traffic that includes credit card information in the CLI:

1. Configure the DLP dictionary:

   config dlp dictionary
       edit "dic-case1"
           config entries
               edit 1
                   set type "credit-card"
               next
           end
       next
   end

2. Configure the DLP sensor:

   config dlp sensor
       edit "sensor-case1"
           config entries
               edit 1
                   set dictionary "dic-case1"
               next
           end
       next
   end

3. Configure the DLP profile:

   config dlp profile
       edit "profile-case1"
           set feature-set proxy
           config rule
               edit 1
                   set name "1"
                   set proto http-get http-post
                   set filter-by sensor
                   set file-type 1
                   set sensor "sensor-case1"
                   set action block
               next
           end
       next
   end

4. Add the DLP profile to a firewall policy:

   config firewall policy
       edit 1
           set srcintf "port2"
           set dstintf "port1"
           set action accept
           set srcaddr "all"
           set dstaddr "all"
           set srcaddr6 "all"
           set dstaddr6 "all"
           set schedule "always"
           set service "ALL"
           set utm-status enable
           set inspection-mode proxy
           set profile-protocol-options "protocol"
           set ssl-ssh-profile "protocols"
           set dlp-profile "profile-case1"
           set nat enable
       next
   end

   When a credit card is included in HTTP POST traffic, a replacement message appears because it is blocked. A DLP log is generated.

Sample log

From Windows, the following command can be used to generate a sample log, using the cURL tool to post data, which contains a sample credit card number:

# curl –k -d 4024007149133315 https://172.16.200.55/card.doc -o?

1: date=2022-10-26 time=11:25:01 eventtime=1666808700281057923 tz="-0700" logid="0954024576" type="utm" subtype="dlp" eventtype="dlp" level="warning" vd="root" ruleid=1 rulename="1" dlpextra="builtin-patterns;sensor-case1" filtertype="sensor" filtercat="file" severity="medium" policyid=1 poluuid="891a526a-51cd-51ed-577a-6505bec88af9" policytype="policy" sessionid=3905 epoch=2143297701 eventid=0 srcip=10.1.100.11 srcport=40370 srccountry="Reserved" srcintf="port2" srcintfrole="undefined" srcuuid="502d2c8e-51cd-51ed-a24e-a091f4ff6fed" dstip=172.16.200.55 dstport=443 dstcountry="Reserved" dstintf="port1" dstintfrole="undefined" dstuuid="502d2c8e-51cd-51ed-a24e-a091f4ff6fed" proto=6 service="HTTPS" filetype="msoffice" direction="outgoing" action="block" hostname="172.16.200.55" url="https://172.16.200.55/card.doc" agent="curl/7.83.1" httpmethod="POST" filename="card.doc" filesize=108 profile="profile-case1"

Example 2: Log FTP upload traffic with a specific pattern

This configuration will log FTP upload traffic with the following patterns:

• keyword = demo
• regex = demo(regex){1,5}
• hex = e6b58be8af95

The dictionary entries have repeat match enabled. The DLP sensor is set so this is repeated five times.

To log FTP upload traffic that has specific keyword, regex, and hex patterns repeated for five times in the GUI:

1. Configure the DLP dictionary with three entries:

   1. Go to Security Profiles > Data Loss Prevention, select the Dictionaries tab, and click Create New.

   2. Enter a name (dic-case2).

   3. In the Dictionary Entries section, click Create New.

   4. Set the Type to keyword and the Pattern to demo.

   5. Enable Repeats and click OK.

      

   6. Repeat these steps to add dictionary entries for the following (with Repeats enabled):

      1. Set the Type to regex and the Pattern to demo(regex){1,5}.

      2. Set the Type to hex and the Pattern to e6b58be8af95.

         

   7. Click OK to save the dictionary.

2. Configure the DLP sensor:

   1. Go to Security Profiles > Data Loss Prevention, select the Sensors tab, and click Create New.

   2. Enter a name (sensor-case2).

   3. In the Sensor Entries section, click Create New.

   4. Set the Dictionary to dic-case2, set the Count to 5, and click OK.

      

   5. Click OK to save the sensor.

3. Configure the DLP profile:

   1. Go to Security Profiles > Data Loss Prevention, select the Profiles tab, and click Create New.

   2. Enter a name (profile-case2).

   3. In the Rules section, click Create New.

   4. Configure the following settings:

      Name	1
      Sensors	sensor-case2
      Severity	Medium
      Action	Block
      Type	File
      File type	builtin-patterns
      Protocol	FTP

      

   5. Click OK.

   6. Click OK to save the profile.

4. Add the DLP profile to a firewall policy:

   1. Go to Policy & Objects > Firewall Policy and click Create New.

   2. Set the Inspection Mode to Proxy-based.

   3. In the Security Profiles section, enable DLP Profile and select profile-case2.

   4. Configure the other settings as needed.

   5. Click OK.

5. Upload a Word document that contains "demo, demo, demo, demoregexregex," using FTP.

   A DLP log is generated after the FTP traffic passes.

To log FTP upload traffic that has specific keyword, regex, and hex patterns repeated for five times in the CLI:

1. Configure the DLP dictionary:

   config dlp dictionary
       edit "dic-case2"
           config entries
               edit 1
                   set type "keyword"
                   set pattern "demo"
                   set repeat enable
               next
               edit 2
                   set type "regex"
                   set pattern "demo(regex){1,5}"
                   set repeat enable
               next
               edit 3
                   set type "hex"
                   set pattern "e6b58be8af95"
                   set repeat enable
               next
           end
       next
   end

2. Configure the DLP sensor:

   config dlp sensor
       edit "sensor-case2"
           config entries
               edit 1
                   set dictionary "dic-case2"
                   set count 5
               next
           end
       next
   end

3. Configure the DLP profile:

   config dlp profile
       edit "profile-case2"
           set feature-set proxy
           config rule
               edit 1 
                   set proto ftp
                   set filter-by sensor
                   set file-type 1
                   set sensor "sensor-case2"
                   set action block
               next
           end
       next
   end

4. Add the DLP profile to a firewall policy:

   config firewall policy
       edit 1
           set srcintf "port2"
           set dstintf "port1"
           set action accept
           set srcaddr "all"
           set dstaddr "all"
           set srcaddr6 "all"
           set dstaddr6 "all"
           set schedule "always"
           set service "ALL"
           set utm-status enable
           set inspection-mode proxy
           set profile-protocol-options "protocol"
           set ssl-ssh-profile "protocols"
           set dlp-profile "profile-case2"
           set nat enable
       next
   end

5. Upload a Word document that contains "demo, demo, demo, demoregexregex," using FTP.

   A DLP log is generated after the FTP traffic passes.

Sample log

1: date=2022-10-26 time=12:37:57 eventtime=1666813077679725858 tz="-0700" logid="0954024576" type="utm" subtype="dlp" eventtype="dlp" level="warning" vd="root" ruleid=1 rulename="1" dlpextra="builtin-patterns;sensor-case2" filtertype="sensor" filtercat="file" severity="medium" policyid=1 poluuid="891a526a-51cd-51ed-577a-6505bec88af9" policytype="policy" sessionid=6267 epoch=909159520 eventid=0 srcip=10.1.100.11 srcport=52858 srccountry="Reserved" srcintf="port2" srcintfrole="undefined" srcuuid="502d2c8e-51cd-51ed-a24e-a091f4ff6fed" dstip=172.16.200.55 dstport=43411 dstcountry="Reserved" dstintf="port1" dstintfrole="undefined" dstuuid="502d2c8e-51cd-51ed-a24e-a091f4ff6fed" proto=6 service="FTP" filetype="msoffice" direction="outgoing" action="block" filename="realizedDoc.doc" filesize=26624 profile="profile-case2"

Example 3: Block HTTPS downloads of EXE files and log HTTPS downloads of files larger than 500 KB

This configuration will block HTTPS downloads of EXE files and log HTTPS downloads of files larger than 500 KB.

To block HTTPS download of EXE files and log downloads larger than 500 KB:

1. Configure the DLP file pattern:

   config dlp filepattern
       edit 3
           set name "case3-exe"
           config entries
               edit "exe"
                   set filter-type type
                   set file-type exe
               next
           end
       next
   end

2. Configure the DLP profile:

   config dlp profile
       edit "profile-case3-type-size"
           config rule
               edit 1
                   set proto http-get
                   set filter-by none
                   set file-type 3
                   set action block
               next
               edit 2
                   set proto http-get
                   set filter-by none
                   set file-size 500
                   set action log-only
               next
           end
       next
   end

3. Add the DLP profile to a firewall policy:

   config firewall policy
       edit 1
           set srcintf "port2"
           set dstintf "port1"
           set action accept
           set srcaddr "all"
           set dstaddr "all"
           set srcaddr6 "all"
           set dstaddr6 "all"
           set schedule "always"
           set service "ALL"
           set utm-status enable
           set inspection-mode proxy
           set ssl-ssh-profile "custom-deep-inspection"
           set dlp-profile "profile-case3-type-size"
           set logtraffic all
           set nat enable
       next
   end

4. Download an EXE file using HTTPS. The download is blocked, a replacement message appears, and a DLP log is generated.

Sample log

1: date=2022-02-15 time=11:54:29 eventtime=1644954869682887856 tz="-0800" logid="0954024577" type="utm" subtype="dlp" eventtype="dlp" level="notice" vd="root" ruleid=2 dlpextra="500 kB" filtertype="none" filtercat="file" severity="medium" policyid=1 poluuid="905fb604-7ed4-51ec-0853-79e498591bf8" policytype="policy" sessionid=12082 epoch=901683674 eventid=0 srcip=10.1.100.18 srcport=59520 srccountry="Reserved" srcintf="port2" srcintfrole="undefined" srcuuid="358d0f56-7ed4-51ec-50f7-a5e4525a641d" dstip=51.81.186.201 dstport=443 dstcountry="United States" dstintf="port1" dstintfrole="undefined" dstuuid="358d0f56-7ed4-51ec-50f7-a5e4525a641d" proto=6 service="HTTPS" direction="incoming" action="log-only" hostname="2.na.dl.wireshark.org" url="https://2.na.dl.wireshark.org/win64/Wireshark-win64-3.6.2.exe" agent="curl/7.61.1" filename="Wireshark-win64-3.6.2.exe" filesize=10502090 profile="profile-case3-type-size"

Example 4: Block HTTPS upload traffic that includes Visa or Mastercard information using evaluation via logical expression

This example will allow users to create a subset of the existing DLP data type, credit-card. It can be very beneficial for an organization that wants to prevent only certain types of credit cards and not all.

This configuration will block HTTPS traffic that includes Visa or Mastercard information. Two dictionary entries with DLP data-type regex are created with custom patterns to match Visa and Mastercard numbers respectively, and a third dictionary entry is created with pre-defined data type credit-card. All three entries are used in the sensor using evaluation via logical expression to further supplement the detection.

In the CLI, evaluation via logical expression can be defined using the command match-eval. It is a tool used to combine multiple entries to define an accurate DLP sensor.

Sample topology

In this example, a Microsoft Office document with Visa credit card information is sent securely to the receiver using the HTTP POST method. The FortiGate intercepts the traffic using deep inspection and blocks the traffic as it matches the DLP profile configured on this FortiGate.

To block HTTPS upload traffic that includes Visa or Mastercard credit card information in the GUI:

1. Configure the DLP dictionary:

   1. Go to Security Profiles > Data Loss Prevention, select the Dictionaries tab, and click Create New.

   2. Create an entry for Visa:

      1. Enter a name (Finance_Credit_Card_Visa).

      2. In the Dictionary Entries section, click Create New.

      3. Set the Type to regex.

      4. Set Pattern to 4[0-9]{12}(?:[0-9]{3}) and click OK.

      5. Click OK to save the dictionary.

   3. Create an entry for Mastercard:

      1. Enter a name (Finance_Credit_Card_Mastercard).

      2. In the Dictionary Entries section, click Create New.

      3. Set the Type to regex.

      4. Set Pattern to (?:5[1-5][0-9]{2}|222[1-9]|22[3-9][0-9]|2[3-6][0-9]{2}|27[01][0-9]|2720)[0-9]{12} and click OK.

      5. Click OK to save the dictionary.

   4. Create an entry for Credit Card:

      1. Enter a name (CC_Number).

      2. In the Dictionary Entries section, click Create New.

      3. Set the Type to credit-card and click OK.

      4. Click OK to save the dictionary.

2. Configure the DLP sensor:

   1. Go to Security Profiles > Data Loss Prevention, select the Sensors tab, and click Create New.

   2. Enter a name (Finance_Credit_Card_High).

   3. In the Sensor Entries section, click Create New.

   4. Set the Dictionary to Finance_Credit_Card_Visa and click OK.

   5. Repeat the previous step twice to add Finance_Credit_Card_Mastercard and CC_Number in this order.

   6. Click OK to save the sensor.

   7. Edit the newly created sensor.

   8. Set the Logical relationship to Evaluate.

   9. In the Evaluated by field, enter (dict(1) > 0 && dict(3) > 0) || (dict(2) > 0 && dict(3) > 0).

   10. Click OK to save the sensor.

       For the DLP sensor with the Logical relationship set to Evaluate, Count and Status of any sensor entry will be ignored.

3. Configure the DLP profile:

   1. Go to Security Profiles > Data Loss Prevention, select the Profiles tab, and click Create New.

   2. Enter a name (cc-block).

   3. In the Rules section, click Create New.

   4. Configure the following settings:

      Name	1
      Sensors	Finance Credit Card High
      Severity	Critical
      Action	Block
      Type	File
      File type	builtin-patterns
      Protocol	HTTP-POST, HTTP-GET

   5. Click OK.

   6. Click OK to save the profile.

4. Add the DLP profile to a firewall policy:

   1. Go to Policy & Objects > Firewall Policy and click Create New.

   2. Set the Inspection Mode to Proxy-based.

   3. In the Security Profiles section, enable DLP Profile and select cc-block.

   4. Set SSL Inspection to deep-inspection to inspect HTTPS traffic.

   5. Configure the other settings as needed.

   6. Click OK.

When a Visa or Mastercard credit card is included in HTTP GET or POST traffic, the file is blocked and a DLP log is generated. See the Sample log for details on how to test this configuration.

To block HTTPS upload traffic that includes Visa or Mastercard credit card information in the CLI:

1. Configure the DLP dictionary:

   config dlp dictionary
       edit "Finance_Credit_Card_Visa"
           config entries
               edit 1
                   set type "regex"
                   set pattern "4[0-9]{12}(?:[0-9]{3})"
                   set repeat enable
                   set comment "Visa"
               next
           end
       next
       edit "Finance_Credit_Card_Mastercard"
           config entries
               edit 1
                   set type "regex"
                   set pattern "(?:5[1-5][0-9]{2}|222[1-9]|22[3-9][0-9]|2[3-6][0-9]{2}|27[01][0-9]|2720)[0-9]{12}"
                   set repeat enable
                   set comment "Mastercard"
               next
           end
       next
       edit "CC_Number"
           config entries
               edit 1
                   set type "credit-card"
               next
           end
       next
   end

   To use "?" in a regex pattern, see CLI basics. This method only supports direct console connection and SSH. It does not support the CLI console in the GUI.

2. Configure the DLP sensor:

   config dlp sensor
       edit "Finance_Credit_Card_High"
           config entries
               edit 1
                      set dictionary "Finance_Credit_Card_Visa"                 
               next
               edit 2
                   set dictionary "Finance_Credit_Card_Mastercard"
               next
               edit 3
                   set dictionary "CC_Number"
               next
           end
           set match-type match-eval
           set eval "(dict(1) > 0 && dict(3) > 0) || (dict(2) > 0 && dict(3) > 0)"
       next
   end

3. Configure the DLP profile:

   config dlp profile
       edit "cc_block"
           set feature-set proxy
           config rule
               edit 1
                   set name "1"
                   set severity critical
                   set proto http-get http-post
                   set filter-by sensor
                   set file-type 1
                   set sensor "Finance_Credit_Card_High"
                   set action block
               next
           end
       next
   end

4. Add the DLP profile to a firewall policy:

   config firewall policy
       edit 1
           set srcintf "port2"
           set dstintf "port3"
           set action accept
           set srcaddr "all"
           set dstaddr "all"
           set schedule "always"
           set service "ALL"
           set utm-status enable
           set inspection-mode proxy
           set ssl-ssh-profile "deep-inspection"
           set dlp-profile "cc_block"
           set nat enable
       next
   end

When a Visa or Mastercard credit card is included in HTTP GET or POST traffic, a replacement message appears because it is blocked. A DLP log is generated. See the Sample log for details on how to test this configuration.

Sample log

From Windows, the following command can be used to generate a sample log via HTTP POST traffic, using the cURL tool to post data, which contains a sample Visa credit card number:

# curl –k -d 4024007149133315 https://192.168.10.13/cc.doc -o?

1: date=2023-03-17 time=15:37:41 eventtime=1679092660998869199 tz="-0700" logid="0954024576" type="utm" subtype="dlp" eventtype="dlp" level="warning" vd="root" ruleid=1 rulename="1" dlpextra="builtin-patterns;Finance_Credit_Card_High" filtertype="sensor" filtercat="file" severity="critical" policyid=1 poluuid="26540ed0-ae54-51ed-80eb-89af8af4d53f" policytype="policy" sessionid=14854 epoch=570215534 eventid=0 srcip=172.20.120.13 srcport=58012 srccountry="Reserved" srcintf="port2" srcintfrole="undefined" srcuuid="3342cb44-9140-51ed-5dbe-8e0787bedeec" dstip=192.168.10.13 dstport=443 dstcountry="Reserved" dstintf="port3" dstintfrole="wan" dstuuid="3342cb44-9140-51ed-5dbe-8e0787bedeec" proto=6 service="HTTPS" filetype="msoffice" direction="incoming" action="block" hostname="192.168.10.13" url="https://192.168.10.13/cc.doc" agent="curl/7.83.1" httpmethod="POST" filename="cc.doc" filesize=12288 profile="cc-block"

Example 5: Block HTTPS upload traffic that includes a MIP label

This configuration will block HTTPS upload traffic that includes a Microsoft Information Protection (MIP) label. See Microsoft Purview Information Protection (formerly MIP) for more information. The pre-defined data type for MIP is used in the dictionary.

Sample topology

In this example, a Microsoft Office document that is marked with an MIP label is being attached to an email in the Chrome browser using Office Desktop. The FortiGate intercepts this traffic using deep inspection and blocks the attachment of the file because it matches the DLP profile that has been set up on this FortiGate.

When a MIP label is included in HTTPS upload traffic, the file is blocked and a DLP log is generated. See Sample log for a log sample.

To block HTTPS upload traffic that includes MIP labels in the GUI:

1. Configure the DLP dictionary:

   1. Go to Security Profiles > Data Loss Prevention, select the Dictionaries tab, and click Create New.

   2. Set Name to dic-case5.

   3. In the Dictionary Entries table click Create New:

      1. Set Type to mip-label.

      2. Set Pattern to 0011bc0f-dd9a-47b5-9a61-bc3b5f442af7.

      3. Click OK.

   4. Click OK.

2. DLP profiles that filter by MIP can only be configured in the CLI. See Configure the DLP profile.

3. Add the DLP profile to a firewall policy:

   1. Go to Policy & Objects > Firewall Policy and click Create New.

   2. Set the Inspection Mode to Proxy-based.

   3. In the Security Profiles section, enable DLP Profile and select profile-case5.

   4. Set SSL Inspection to deep-inspection.

   5. Configure the other settings as needed.

   6. Click OK.

To block HTTPS upload traffic that includes MIP labels in the CLI:

1. Configure the DLP dictionary:

   config dlp dictionary
       edit "dic-case5"
           config entries
               edit 1
                   set type "mip-label"
                   set pattern "0011bc0f-dd9a-47b5-9a61-bc3b5f442af7"
               next
           end
       next
   end

2. Configure the DLP profile:

   config dlp profile
       edit "profile-case5"
           set feature-set proxy
           config rule
               edit 1
                   set name "mip-label"
                   set severity critical
                   set proto smtp pop3 imap http-get http-post ftp nntp mapi ssh cifs
                   set filter-by mip
                   set file-type 1
                   set label "dic-case5"
                   set action block
               next
           end
       next
   end

3. Add the DLP profile to a firewall policy:

   config firewall policy
       edit 1
           set srcintf "port2"
           set dstintf "port1"
           set action accept
           set srcaddr "all"
           set dstaddr "all"
           set schedule "always"
           set service "ALL"
           set utm-status enable
           set inspection-mode proxy
           set ssl-ssh-profile "deep-inspection"
           set dlp-profile "profile-case5"
           set nat enable
       next
   end

Sample log

An attempt was made to send an email from a Windows device using Gmail's webmail service. The email was intended to include an attachment with a MIP label, but the attachment failed to upload, resulting in the generation of a sample log.

1: date=2023-11-02 time=06:31:07 eventtime=1698863466313615946 logid="0954024576" type="utm" subtype="dlp" eventtype="dlp" level="warning" vd="root" ruleid=1 rulename="1" dlpextra="dic-case5" filtertype="mip" filtercat="file" severity="critical" policyid=1 poluuid="8bd1908e-7839-51ee-e86b-e411056688ec" policytype="policy" sessionid=2988 epoch=1712884745 eventid=0 srcip=10.10.10.1 srcport=49985 srccountry="Reserved" srcintf="port2" srcintfrole="lan" srcuuid="d2f06fda-15e7-51ee-0d22-faaf5170dad2" dstip=142.251.211.229 dstport=443 dstcountry="United States" dstintf="port1" dstintfrole="lan" dstuuid="d2f06fda-15e7-51ee-0d22-faaf5170dad2" proto=6 service="HTTPS" filetype="msoffice" direction="outgoing" action="block" hostname="mail.google.com" url="https://mail.google.com/_/upload?authuser=0&dcp=asu-n&upload_id=ABPtcPoZPYAkCzE-FaGZS_QUNjml-0vPOGdjf7nk02kKLLnoTmg-wqsAbeWfuzerDACV0b8dZ6v0bkUZnB57Is1QdvjFBE2r90bT&upload_protocol=resumable" agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" httpmethod="POST" referralurl="https://mail.google.com/mail/u/0/" filename="doc.doc" filesize=53248 profile="profile-case5"