From f78274b78c7346ec00aa1b09ba28bba5b3fe8057 Mon Sep 17 00:00:00 2001 From: Brian Smith Date: Tue, 1 Sep 2026 09:29:56 +0200 Subject: [PATCH 1/3] feat: add docs pages for DLP --- .../policies/ContentAnalysisTelemetry.mdx | 37 ++++++++++++++ .../reference/policies/DataLossPrevention.mdx | 49 +++++++++++++++++++ src/plugins/inject-oma-uri.mjs | 4 ++ 3 files changed, 90 insertions(+) create mode 100644 src/content/docs/reference/policies/ContentAnalysisTelemetry.mdx create mode 100644 src/content/docs/reference/policies/DataLossPrevention.mdx diff --git a/src/content/docs/reference/policies/ContentAnalysisTelemetry.mdx b/src/content/docs/reference/policies/ContentAnalysisTelemetry.mdx new file mode 100644 index 0000000..84ba6de --- /dev/null +++ b/src/content/docs/reference/policies/ContentAnalysisTelemetry.mdx @@ -0,0 +1,37 @@ +--- +title: "ContentAnalysisTelemetry" +description: "Enable and configure security logging when a DLP rule is triggered." +category: "Cloud reporting" +--- + +Enable and configure logging of Data Loss Prevention events. + +When a DLP rule is triggered, Firefox records the event and submits it in the `enterprise` telemetry ping, which is kept separate from general Firefox telemetry. +Events are logged with full URLs by default, so this policy is normally used to turn logging off or to reduce what it records. + +Values set by this policy are locked, so users cannot change them. + +## Compatibility + + + +**CCK2 Equivalent:** N/A\ +**Preferences Affected:** `browser.contentanalysis.enterprise.telemetry.enabled`, `browser.contentanalysis.enterprise.telemetry.urlLogging` + +## Examples + + + +## Values + +- `Enabled`: A Boolean. If `false`, DLP events are not recorded. The default is `true`. +- `UrlLogging`: Controls how much URL information each event records. The default is `full`. + - `full`: Log complete URLs, including paths and parameters. + - `domain`: Log only URL hostnames. + - `none`: Do not log URL information. + +## See also + +- [`ContentAnalysis`](/reference/policies/contentanalysis/) policy configures DLP through an external agent. +- [`DataLossPrevention`](/reference/policies/datalossprevention/) policy configures the built-in DLP rules. +- [`SecurityLogging`](/reference/policies/securitylogging/) policy covers other security-relevant events. diff --git a/src/content/docs/reference/policies/DataLossPrevention.mdx b/src/content/docs/reference/policies/DataLossPrevention.mdx new file mode 100644 index 0000000..f452439 --- /dev/null +++ b/src/content/docs/reference/policies/DataLossPrevention.mdx @@ -0,0 +1,49 @@ +--- +title: "DataLossPrevention" +description: "Configure built-in Data Loss Prevention rules that warn on or block data actions per domain." +category: "Cloud reporting" +--- + +Configure built-in Data Loss Prevention (DLP) rules that warn on or block data actions per domain. + +Unlike [`ContentAnalysis`](/reference/policies/contentanalysis/), which hands each operation to an external agent, this policy is evaluated by the built-in DLP engine, so no agent has to be manually installed. + +Only one DLP service can be active: + +- If `ContentAnalysis` has `Enabled` set to `true`, the external agent (`ContentAnalysis`) wins and these rules are ignored. +- If `ContentAnalysis` is absent, or present without enabling an agent, the built-in `DataLossPrevention` rules apply. + +## Compatibility + + + +**CCK2 Equivalent:** N/A\ +**Preferences Affected:** `browser.contentanalysis.agent_name`, `browser.contentanalysis.agent_timeout`, `browser.contentanalysis.allow_url_regex_list`, `browser.contentanalysis.bypass_for_same_tab_operations`, `browser.contentanalysis.default_result`, `browser.contentanalysis.deny_url_regex_list`, `browser.contentanalysis.dlp_rules`, `browser.contentanalysis.enabled`, `browser.contentanalysis.interception_point.clipboard.enabled`, `browser.contentanalysis.interception_point.clipboard.plain_text_only`, `browser.contentanalysis.interception_point.download.enabled`, `browser.contentanalysis.interception_point.drag_and_drop.enabled`, `browser.contentanalysis.interception_point.drag_and_drop.plain_text_only`, `browser.contentanalysis.interception_point.file_upload.enabled`, `browser.contentanalysis.interception_point.print.enabled`, `browser.contentanalysis.show_blocked_result`, `browser.contentanalysis.timeout_result`, `browser.contentanalysis.use_wasm_backend` + +## Examples + + + +## Values + +- `FallbackResult`: What happens to an operation the engine cannot reach a verdict on, including a request that has timed out. The default is `block`. + - `block`: Deny the operation. + - `warn`: Warn the user and let them choose whether to continue. + - `allow`: Allow the operation. +- `AllowUrlRegexList`: A space-separated list of regular expressions. + Operations on matching URLs are always allowed, without being checked against the rules. +- `Rules`: The list of DLP rules. Each rule takes: + - `Name`: (**required**) An identifier for the rule, using lowercase letters, digits, and hyphens, up to 64 characters. + - `Enabled`: A Boolean. A rule only takes effect when this is `true`. + - `Actions`: (**required**) The data actions the rule covers, at least one of `TextPaste`, `FileUpload`, `FileDownload`, and `Print`. + - `Domains`: (**required**) The domains the rule applies to, at least one. + - `ContentPatterns`: A list of regular expressions matched against the content of the operation. + If a pattern is not a valid regular expression, the whole rule is dropped and the problem is reported in `about:policies#errors`. + - `Type`: (**required**) What the rule does when it matches, either `warn` or `block`. + - `Message`: The text shown to the user when the rule triggers. + +## See also + +- [`ContentAnalysisTelemetry`](/reference/policies/contentanalysistelemetry/) policy controls what is logged when a rule is triggered. +- [`ContentAnalysis`](/reference/policies/contentanalysis/) policy configures DLP through an external agent. +- [`SecurityLogging`](/reference/policies/securitylogging/) policy covers other security-relevant events. diff --git a/src/plugins/inject-oma-uri.mjs b/src/plugins/inject-oma-uri.mjs index 86dfc4c..f2f3027 100644 --- a/src/plugins/inject-oma-uri.mjs +++ b/src/plugins/inject-oma-uri.mjs @@ -10,11 +10,15 @@ const DOC_URL = "https://mozilla.github.io/policy-templates/oma-uris"; // Policies with no ADMX equivalent. const NO_ADMX_EQUIVALENT = new Set([ "3rdparty", // The extension developer supplies their own ADMX. + "ContentAnalysisTelemetry", // Configured through the admin console, not local policy. + "DataLossPrevention", // Configured through the admin console, not local policy. "DisableLocalPolicies", // Registry bootstrap, outside the ADMX namespace. "DisablePocket", // Deprecated, deliberately omitted upstream. "EnterprisePoliciesEnabled", // Registry bootstrap, outside the ADMX namespace. + "EnterpriseStorageEncryption", // Configured through the admin console, not local policy. "MicrosoftEntraSSO", // macOS only. "SecurityLogging", // Configured through the admin console, not local policy. + "Watermark", // Configured through the admin console, not local policy. ]); // TODO: Missing from `firefox.admx` From 2f762e8855c54729a51b81e6cb4998bb53e1008e Mon Sep 17 00:00:00 2001 From: Brian Smith Date: Tue, 1 Sep 2026 12:21:29 +0200 Subject: [PATCH 2/3] Apply suggestion from @bsmth --- src/plugins/inject-oma-uri.mjs | 1 - 1 file changed, 1 deletion(-) diff --git a/src/plugins/inject-oma-uri.mjs b/src/plugins/inject-oma-uri.mjs index f2f3027..b233e5e 100644 --- a/src/plugins/inject-oma-uri.mjs +++ b/src/plugins/inject-oma-uri.mjs @@ -15,7 +15,6 @@ const NO_ADMX_EQUIVALENT = new Set([ "DisableLocalPolicies", // Registry bootstrap, outside the ADMX namespace. "DisablePocket", // Deprecated, deliberately omitted upstream. "EnterprisePoliciesEnabled", // Registry bootstrap, outside the ADMX namespace. - "EnterpriseStorageEncryption", // Configured through the admin console, not local policy. "MicrosoftEntraSSO", // macOS only. "SecurityLogging", // Configured through the admin console, not local policy. "Watermark", // Configured through the admin console, not local policy. From 42f30e44d09fe4a7567a089a2156d0e10b5dde9d Mon Sep 17 00:00:00 2001 From: Brian Smith Date: Tue, 1 Sep 2026 21:32:09 +0200 Subject: [PATCH 3/3] Apply suggestions from code review Co-authored-by: Jonathan Mendez Co-authored-by: Brian Smith --- .../docs/reference/policies/ContentAnalysisTelemetry.mdx | 6 +++--- src/content/docs/reference/policies/DataLossPrevention.mdx | 6 +++--- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/src/content/docs/reference/policies/ContentAnalysisTelemetry.mdx b/src/content/docs/reference/policies/ContentAnalysisTelemetry.mdx index 84ba6de..5426b1b 100644 --- a/src/content/docs/reference/policies/ContentAnalysisTelemetry.mdx +++ b/src/content/docs/reference/policies/ContentAnalysisTelemetry.mdx @@ -1,10 +1,10 @@ --- title: "ContentAnalysisTelemetry" -description: "Enable and configure security logging when a DLP rule is triggered." +description: "Enable and configure security logging when a Data Loss Prevention (DLP) rule is triggered." category: "Cloud reporting" --- -Enable and configure logging of Data Loss Prevention events. +Enable and configure logging of Data Loss Prevention (DLP) events. When a DLP rule is triggered, Firefox records the event and submits it in the `enterprise` telemetry ping, which is kept separate from general Firefox telemetry. Events are logged with full URLs by default, so this policy is normally used to turn logging off or to reduce what it records. @@ -33,5 +33,5 @@ Values set by this policy are locked, so users cannot change them. ## See also - [`ContentAnalysis`](/reference/policies/contentanalysis/) policy configures DLP through an external agent. -- [`DataLossPrevention`](/reference/policies/datalossprevention/) policy configures the built-in DLP rules. +- [`DataLossPrevention`](/reference/policies/datalossprevention/) policy configures DLP through the built-in engine. - [`SecurityLogging`](/reference/policies/securitylogging/) policy covers other security-relevant events. diff --git a/src/content/docs/reference/policies/DataLossPrevention.mdx b/src/content/docs/reference/policies/DataLossPrevention.mdx index f452439..e952927 100644 --- a/src/content/docs/reference/policies/DataLossPrevention.mdx +++ b/src/content/docs/reference/policies/DataLossPrevention.mdx @@ -1,6 +1,6 @@ --- title: "DataLossPrevention" -description: "Configure built-in Data Loss Prevention rules that warn on or block data actions per domain." +description: "Configure built-in Data Loss Prevention (DLP) rules that warn on or block data actions per domain." category: "Cloud reporting" --- @@ -36,11 +36,11 @@ Only one DLP service can be active: - `Name`: (**required**) An identifier for the rule, using lowercase letters, digits, and hyphens, up to 64 characters. - `Enabled`: A Boolean. A rule only takes effect when this is `true`. - `Actions`: (**required**) The data actions the rule covers, at least one of `TextPaste`, `FileUpload`, `FileDownload`, and `Print`. - - `Domains`: (**required**) The domains the rule applies to, at least one. + - `Domains`: (**required**) The domains the rule applies to, at least one. Use `*` to match all domains. - `ContentPatterns`: A list of regular expressions matched against the content of the operation. If a pattern is not a valid regular expression, the whole rule is dropped and the problem is reported in `about:policies#errors`. - `Type`: (**required**) What the rule does when it matches, either `warn` or `block`. - - `Message`: The text shown to the user when the rule triggers. + - `Message`: Text shown to the user when the rule triggers. ## See also