Create Content Compliance Rule - Monitoring

Learn how to create a monitoring content compliance rule in the Google Workspace.

This document is only applicable to new customers who are setting up Gmail DLP for the first time. If you are an existing customer and have setup Gmail DLP previously, refer this documentation.

The first content compliance rule is used to monitor all outgoing emails.

Important

It is mandatory for you to create this rule to monitor outgoing emails for sensitive data. You should always create a content compliance rule on a test OU, qualify email deliverability is not impacted at all before you enable it across all OU's. Please work with your Nightfall Customer Success Manager (CSM) to setup and deploy inline scanning for Gmail.

Note: Please set up SMTP relay settings and whitelist Nightfall IP addresses before you create content compliance rules. If the SMTP relay settings in Google Workspace are not whitelisted, it is likely emails will be dropped.

Summary

1. Setup Host and Route

2. Setup "Email Messages to Affect"

3. Add the Regex Expressions

4. Modify Message and Add Custom Headers

Prerequisites

In the Nightfall UI, navigate to Integrations > click the Manage button for Gmail integration.

All Compliance Rule headers and expression are available in Gmail (Manage) > Installation.

Keep this screen open to copy/paste the headers and expressions into Gmail throughout the process.

Content Compliance

Step 1: Setup Host and Route

The steps to create content compliance rule are as follows.

1. Login to Google Workspace with an admin account > navigate to the Admin console.

2. From the left menu, Apps > Google Workspace > Gmail > Hosts > click ADD ROUTE

1. Name: (Anything)

2. Host Name: 2r2xfv8u7uz5.fips.qbns.mail-manager-smtp.amazonaws.com

3. Port: 25

4. Click Save.

Step 2: Setup "Email Messages to Affect"

1. Under Settings for Gmail, scroll down and click Compliance.

The list of Organization Units (OUs) is visible on the left of the screen (see image below).

You can directly configure the compliance rules and routing rules on your production OU (OU at the top most level) by selecting the same.

NOTE: Nightfall recommends to initially configure the rules on a subset OU (one of the nested OUs), for testing/monitoring purposes. Once the configuration is working as expected on the nested OU, you can configure the compliance rules on the production OU.

1. Navigate to Content Compliance > click ADD ANOTHER RULE. NOTE: If you have not created any Compliance rule previously, the button might be displayed as CONFIGURE.

1. Enter a name for the compliance rule, such as "Nightfall DLP".

2. Navigate to Email messages to affect:

   1. Select Outbound

   2. Select Internal - Sending

If you select only the Outbound check box, only those emails that are routed out of your organization to external domains, are scanned. If you wish to scan internal emails (emails that are sent between the employees of your organization). you must select the Internal - Sending check box.

Step 3: Add Expressions

1. In step 2 of the content compliance rule, select:

   • If ALL of the following match the message

2. Add two expressions in step 2 of content compliance rule. Click ADD.

1. Set the following settings within the "Add setting" dialog box:

   1. Change Simple Content Match > Advanced Content match.

   2. Location: Select Sender header

   3. Match type: Select Matches Regex

   4. Regexp: Copy from Nightfall Gmail > Monitoring Content Compliance Rule header:

      1. For a single domain:

         • .*@<your-domain>\.<suffix>$

      2. For more than one domain:

         • (.*@<your-domain>\.<suffix>$|.**@<your-domain>\.<suffix>$)

   5. Regexp: Adjust the regular expression to match your organization name. See example below.

For example, if your organization name is Contoso.com, you can create the regular expression as .*@contoso\.com$

If you are using multiple domains to send emails from your organization and you need to scan outgoing emails from all those domains for sensitive data, you can use a regular expression to specify multiple domains as illustrated in installation instructions in the Nightfall console. For example, ([e-mail]$|[e-mail]$)

1. Click SAVE.

1. Add a second Expression under the same area by clicking Add.

   1. Change Simple Content Match > Advanced Content match.

   2. Location: Select Full headers

   3. Match type: Select Not Contains text

   4. Content: From Nightfall Gmail > Full Header > copy/paste the Header field:

      • "x-nightfall-scanned"

2. Click SAVE.

The condition expression is created as follows. This expression ensures that all the emails that are not yet scanned by Nightfall are scanned.

Step 4: Modify Message and Add Custom Headers

1. In step 3, select Modify message.

2. Under the Headers section, select the Add X-Gm-Original-To header check box.

3. Select the Add custom headers check box. The Custom headers section is displayed once you select this check box.

4. Click ADD under Custom headers to add a new custom header.

There are two fields; Header key and Header value.

1. From the other tab for the Nightfall Console for Nightfall Gmail, copy/paste:

   1. Messaging Modification: Authentication field value > paste into Header Key

   2. Messaging Modification: Nightfall UUID field value > paste into Header value

2. Click SAVE.

1. Scroll down to the Route section

   1. select Change Route

   2. click the dropdown

   3. select the routing rule created in the Content Compliance Rule section (step 5).

      

1. Scroll to the Encryption (onward delivery only) section

   • select Require secure transport (TLS).

2. Click SAVE.