feat: add docs pages for DLP #305
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,37 @@ | ||
| --- | ||
| title: "ContentAnalysisTelemetry" | ||
| description: "Enable and configure security logging when a Data Loss Prevention (DLP) rule is triggered." | ||
| category: "Cloud reporting" | ||
| --- | ||
|
|
||
| Enable and configure logging of Data Loss Prevention (DLP) events. | ||
|
|
||
| When a DLP rule is triggered, Firefox records the event and submits it in the `enterprise` telemetry ping, which is kept separate from general Firefox telemetry. | ||
| Events are logged with full URLs by default, so this policy is normally used to turn logging off or to reduce what it records. | ||
|
|
||
| Values set by this policy are locked, so users cannot change them. | ||
|
|
||
| ## Compatibility | ||
|
|
||
| <PolicyCompat policy="ContentAnalysisTelemetry" /> | ||
|
|
||
| **CCK2 Equivalent:** N/A\ | ||
| **Preferences Affected:** `browser.contentanalysis.enterprise.telemetry.enabled`, `browser.contentanalysis.enterprise.telemetry.urlLogging` | ||
|
|
||
| ## Examples | ||
|
|
||
| <PolicyExample policy="ContentAnalysisTelemetry" /> | ||
|
|
||
| ## Values | ||
|
|
||
| - `Enabled`: A Boolean. If `false`, DLP events are not recorded. The default is `true`. | ||
| - `UrlLogging`: Controls how much URL information each event records. The default is `full`. | ||
|
Comment on lines
+27
to
+28
Contributor
There was a problem hiding this comment. ditto about default behaviors potentially changing |
||
| - `full`: Log complete URLs, including paths and parameters. | ||
| - `domain`: Log only URL hostnames. | ||
| - `none`: Do not log URL information. | ||
|
|
||
| ## See also | ||
|
|
||
| - [`ContentAnalysis`](/reference/policies/contentanalysis/) policy configures DLP through an external agent. | ||
| - [`DataLossPrevention`](/reference/policies/datalossprevention/) policy configures DLP through the built-in engine. | ||
| - [`SecurityLogging`](/reference/policies/securitylogging/) policy covers other security-relevant events. | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,49 @@ | ||
| --- | ||
| title: "DataLossPrevention" | ||
| description: "Configure built-in Data Loss Prevention (DLP) rules that warn on or block data actions per domain." | ||
| category: "Cloud reporting" | ||
| --- | ||
|
|
||
| Configure built-in Data Loss Prevention (DLP) rules that warn on or block data actions per domain. | ||
|
|
||
| Unlike [`ContentAnalysis`](/reference/policies/contentanalysis/), which hands each operation to an external agent, this policy is evaluated by the built-in DLP engine, so no agent has to be manually installed. | ||
|
|
||
| Only one DLP service can be active: | ||
|
|
||
| - If `ContentAnalysis` has `Enabled` set to `true`, the external agent (`ContentAnalysis`) wins and these rules are ignored. | ||
| - If `ContentAnalysis` is absent, or present without enabling an agent, the built-in `DataLossPrevention` rules apply. | ||
|
|
||
| ## Compatibility | ||
|
|
||
| <PolicyCompat policy="DataLossPrevention" /> | ||
|
|
||
| **CCK2 Equivalent:** N/A\ | ||
| **Preferences Affected:** `browser.contentanalysis.agent_name`, `browser.contentanalysis.agent_timeout`, `browser.contentanalysis.allow_url_regex_list`, `browser.contentanalysis.bypass_for_same_tab_operations`, `browser.contentanalysis.default_result`, `browser.contentanalysis.deny_url_regex_list`, `browser.contentanalysis.dlp_rules`, `browser.contentanalysis.enabled`, `browser.contentanalysis.interception_point.clipboard.enabled`, `browser.contentanalysis.interception_point.clipboard.plain_text_only`, `browser.contentanalysis.interception_point.download.enabled`, `browser.contentanalysis.interception_point.drag_and_drop.enabled`, `browser.contentanalysis.interception_point.drag_and_drop.plain_text_only`, `browser.contentanalysis.interception_point.file_upload.enabled`, `browser.contentanalysis.interception_point.print.enabled`, `browser.contentanalysis.show_blocked_result`, `browser.contentanalysis.timeout_result`, `browser.contentanalysis.use_wasm_backend` | ||
|
|
||
| ## Examples | ||
|
|
||
| <PolicyExample policy="DataLossPrevention" /> | ||
|
|
||
| ## Values | ||
|
|
||
| - `FallbackResult`: What happens to an operation the engine cannot reach a verdict on, including a request that has timed out. The default is `block`. | ||
| - `block`: Deny the operation. | ||
| - `warn`: Warn the user and let them choose whether to continue. | ||
| - `allow`: Allow the operation. | ||
| - `AllowUrlRegexList`: A space-separated list of regular expressions. | ||
| Operations on matching URLs are always allowed, without being checked against the rules. | ||
| - `Rules`: The list of DLP rules. Each rule takes: | ||
| - `Name`: (**required**) An identifier for the rule, using lowercase letters, digits, and hyphens, up to 64 characters. | ||
| - `Enabled`: A Boolean. A rule only takes effect when this is `true`. | ||
| - `Actions`: (**required**) The data actions the rule covers, at least one of `TextPaste`, `FileUpload`, `FileDownload`, and `Print`. | ||
| - `Domains`: (**required**) The domains the rule applies to, at least one. Use `*` to match all domains. | ||
| - `ContentPatterns`: A list of regular expressions matched against the content of the operation. | ||
| If a pattern is not a valid regular expression, the whole rule is dropped and the problem is reported in `about:policies#errors`. | ||
| - `Type`: (**required**) What the rule does when it matches, either `warn` or `block`. | ||
| - `Message`: Text shown to the user when the rule triggers. | ||
|
|
||
| ## See also | ||
|
|
||
| - [`ContentAnalysisTelemetry`](/reference/policies/contentanalysistelemetry/) policy controls what is logged when a rule is triggered. | ||
| - [`ContentAnalysis`](/reference/policies/contentanalysis/) policy configures DLP through an external agent. | ||
| - [`SecurityLogging`](/reference/policies/securitylogging/) policy covers other security-relevant events. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I think the default behavior (at least being enabled, but potentially the default URL level of detail) may change with Bug 2067262. I don't know if it's worth settling when/whether the bug will be implemented before stating the default behavior here?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Let's update this page when the "default off" implementation lands so that we keep docs reflecting current state (reality) and there's less chance of drift from what's actually shipping, do you agree?