Lakhasly

1.3.9 Solution should be able to setup "Data class" attribute for captured files and documents based on data classification methods. 3.10 Solution should be able to capture from documents and check TITUS tags 3.11 Solution should be able to use in policy verification condition current daily UBA indicator for particular user 3.12 Solution should be able to copy existing policy 3.13 Solution should be able to setup duration period for particular policy and execution schedule (once, daily, weekly etc.) 3.14 Solution should be able to use as verification condition other policies that that was used on earlier verification steps for this particular object 3.15 Solution should be able to capture text from file combined from several binary objects with text 3.16 Solution should be able to setup required level of nested levels in archive file for data capturing 3.17 Solution should be able to perform backup export of all system settings data to structured file 3.18 Solution should be able to write incidents to SIEM instance using UDP and TCP protocol with the following protocols: CEF, LEEF, BSD syslog (RFC 3164), Syslog (RFC 5424) 3.19 Solution should be able to protect endpoint agent module against uninstallation in Programs and features console on workstation 3.20 Solution should be able to setup customizable uninstall password for agent module in Programs and features console on workstation 3.21 Solution should be able to perform hiding endpoint agent signs in the following in MS Windows consoles:

• Agent processes in "Task manager" console
• Entry in "Programs and features" console
• Entry in "System services" console
• File Explorer of OS. 3.22 Solution should provide endpoint agent launch in secure boot in MS Windows on workstation 3.23 Solution should be able to receive incidents and perform data sharing with workstations, which are not included in corporate MS Active Directory domain 3.24 Solution should be able export list of workstations where DLP agent is installed with the following details: host name and IP, DLP modules version, last synchronization date\time, policies and configuration settings 3.25 Solution should be able to open live monitoring session in management web console for particular workstation and user with the following options:
• User's workspace live monitoring session
• Making snapshots form the local web camera.5.10 Solution should be able to perform control and block file operations with files in peripheral and removable devices connected over MTP protocol 5.11 Solution should be able to manage size of the local storage of logs and shadow copies on endpoints 5.12 Solution should be able to perform selective file encryption to a USB removable device based on the contents analysis permission or file type of the copied file for particular policy 5.13 Solution should be able to perform files decryption only on workstations with installed endpoint DLP module 5.14 Solution should be able to capture microphone record from user workstation based on policies 5.15 Solution should be able to capture keystrokes from keyboard on user workstation 5.16 Solution should be able to capture photos from web-camera on user's workstation 5.17 Solution should be able to launch live monitoring session of user's workspace in active OS session by command from officer 5.18 Solution should be able to create snapshot of web-camera on user's PC by command from officer 5.19 Solution should be able to add customizable watermark in user's workspace on top of specific application launched in workstation 5.20 Solution should be able to add customizable text to the watermark for specific application or groups of applications 5.21 Solution should be able to block print screen operation in workstation for specific application launched 5.22 Solution should have application launch control module at endpoint to log and block EXE file execution on workstation 5.23 Solution should be able to create and apply new category in the launch control policies with customized group of applications 5.24 Solution should be able to create new application entity with file path to its EXE or CRC fingerprint of target EXE file 5.25 Solution should be able to capture screenshots of workspace from user workstation (PNG and JPG file formats) 5.26 Solution should be able to process request from the user to obtain advanced access within the current set of local policies by means of the following methods:
• Request to the system administrator over email
• Unique code ID sharing and confirmation response code ID from system administrator over telephone.Detailed requirements for policy server module 3.1 Solution should have unified single policy server with the following policy creation schema: Selected Channel - Scope of verification rules - Auto executable system action 3.2 Solution should have single DLP management modern look web console for system officers and administrators to perform policy customization in policy creation wizard 3.3 Policy server should be able to implement particular policy to all or the following selected channels: Web Internet, SMTP mail, Instant Messengers, Printers, Removable devices, Clipboard, Keyboard on Workstation, Screen in workstation, Microphone in workstation, Web camera in workstation and Discovery crawler 3.4 Solution should be able to setup in policy creation wizard the following verification rules:
• Incident attributes verification (User name, IP address, host name, file size, channel, recipient name, sender name, file text, body text, device name, incident type, web service, process, document metadata properties, current user's UBA index, user status, triggered policy, amount of printed pages, user belong to specific domain etc.)
• Verification using particular digital fingerprints
• Verification using particular dictionaries
• File type verification (text, graphic, audio, video, archive, executable, encrypted data, unknown type) 3.5 Solution should be able to setup in policy creation wizard the following auto executable system actions:
• Create incident in system repository with the following attributes: o Incident severity (high, medium or low) o Assign specific label to the incident o Assign customizable risk score value.Detailed requirements for Traffic Control module 4.1 Solution should be able to capture mail traffic both at mail server and at endpoint agent module 4.2 Solution should be able to capture SMTP, IMAP, POP3 mail traffic 4.3 Solution should be able to receive and analyze outgoing and incoming SMTP mail traffic from corporate SMTP mail servers 4.4 Solution should be able to control internal mail traffic from internal users on MS Exchange server 2007/2010/2013/2016 4.5 Solution should be able to install DLP interceptor plugin module on MS Exchange server 2007/2010/2013/2016 4.6 Solution should be able to receive over POP3 and HTTPS protocols mirrored mail traffic from operate mail SMTP server 4.7 Solution should be able to block mail in system mail quarantine 4.8 Solution should be able to install mail interceptor plugin module in Microsoft Outlook 2007/2010/2013/2016 and Mozilla Thunderbird at user's workstation 4.9 Solution should be able to capture HTTP/HTTPS traffic both at operational web-gateway module over ICAP protocol and at endpoint agent module 4.10 Solution should be able to decrypt and capture https traffic at endpoint using man in the middle (MITM) algorithm 4.11 Solution should be able to decrypt and capture https traffic at endpoint using deep API integration with the following browsers: Chrome, IE 8+, Firefox, Opera and Edge 4.12 Solution should be able to block web traffic in browser level using deep API integration without MITM tools 4.13 Solution should be able to capture FTP traffic 4.14 Solution should be able to capture the traffic from the following list of public web services: Gmail, Yahoo Mail, Google Docs, Office 365, OneDrive, Google Search, Facebook, Dropbox, LinkedIn, Live Journal, Twitter, YouTube, Deposit files etc.4.15 Solution should be able to capture the traffic from Outlook Web App 4.16 Solution should be able to capture and log instant messenger traffic for the following messengers: WhatsApp, Telegram, ICQ, Skype, Viber and Jabber 4.17 Solution should be able to capture and block the following objects from WhatsApp thick client traffic flow: text chat messages and attached files 4.18 Solution should be able to capture and block the following objects from Telegram thick client traffic flow: text chat messages, attached files, audio records of voice session 4.19 Solution should be able to decrypt, capture and block instant messenger traffic from WhatsApp web service and Telegram web service opened in web browser on workstation 4.20 Solution should be able to decrypt, capture and log the following traffic from Skype application: text chat messages, attached files, audio records of voice session 4.21 Solution should be able to block launch of Skype application at user's workstation 4.22 Solution should be able to block file transfer via Skype application at user's workstation 4.23 Solution should be able to capture and log the following traffic from MS Teams desktop and Web Teams application: text chat messages, attached files, audio records of voice session 4.24 Solution should be able to setup the list of the applications whose internet traffic is processed by the endpoint DLP agent 4.25 Solution should be able to setup the list of the applications whose internet traffic is ignored by the endpoint DLP agent 4.26 Solution should be able to setup the lists of applications whose internet traffic should and should not be controlled or blocked by the agent 4.27 Solution should be able to setup the list of the applications that are allowed to establish incoming\outgoing connections 4.28 Solution should be able to setup the list of the applications whose incoming\outgoing connections are blocked 4.29 Solution should be able to setup the list of the hosts whose incoming and outgoing SSL traffic is not decrypted and not analyzed 4.30 Solution should be able to specify when the agent controls traffic on endpoint agent:
• Corp domain available locally: the computer is connected to the local network
• Corp domain available via VPN: the computer is connected to the domain via VPN
• Corp domain unavailable: there is no active connection between the workstation and corp domain.1.2 Solution should have unified policy server where all system policy with filtering and verification rules, data classification methods and verification algorithms will be stored 1.3 Solution should have unified repository server to gather and retain all incidents from all monitored channels and users workstation with system attributes and shadow copy of original violated file or document 1.4 Solution should have unified DLP management web console for system officers and administrators to perform policy violation cases investigations, settings management and policies customization for all DLP modules and components 1.5 Solution should allow system officers and administrators to manage all settings and get access to incidents repository over unified DLP management web console 1.6 Solution should be able to collect and retain all incidents in one single database in system repository server based on RDBMS MS SQL Server 2019 and any later or PostgreSQL 9.6/10 or above 1.7 Solution should have unified single log server to log and store all system logs from other system servers and modules 1.8 Solution should have single deployment management server module to manage endpoint agents deployment 1.9 Solution should be able to deploy all server modules and components on single server instance with Microsoft Windows Server 2008R2/2012/2012R2/16/19/22 (x64) and Ubuntu Linux LTS 22.04.Detailed requirements for Device Control module 5.1 Solution should be able to setup access control list (ACL) for particular peripheral and removable devices based on set of active policies for specific user 5.2 Solution should be able to setup access control list (ACL) for particular peripheral and removable devices (USB devices, Removable media etc) for the specific user with the following access rights: Full Access, Reading, Writing 5.3 Solution should be able to perform file operations control with peripheral and removable devices based on set of active policies for specific user 5.4 Solution should be able to perform file content analysis for file and document on peripheral and removable devices based on set of active policies for specific user 5.5 Solution should be able to perform control and block file operations with files in peripheral and removable USB devices based on the following policy verification rules: file attributes, document text digital fingerprints, content analysis with dictionaries and file types 5.6 Solution should be able to capture and create shadow copy for all violated files and documents 5.7 Solution should be able to perform control of printing operations and block file printing on printer devices based on the following policy verification rules: file attributes, document text digital fingerprints, content analysis with dictionaries and file types 5.8 Solution should have the following list of built-in device types classification for the use in device control policy creator wizard:
• Typical device classes: USB devices, network devices, DVD/CD drives, removable media, printers, hard drives, PCMCAI adapters, modems, IrDA etc.Detailed requirements for Discovery Control module 6.1 Solution should be able to perform files scanning on workstations with installed endpoint DLP module in live mode or based on the schedule 6.2 Solution should be able to capture and create shadow copy for all violated files and documents 6.3 Solution should be able to perform scanning based on the following policy verification rules: file attributes, document text digital fingerprints, content analysis with dictionaries and file types 6.4 Solution should be able to setup target scope of folder on workstations that would not be scanned 6.5 Solution should have crawler module to perform remote scanning in shared folders on the file server 6.6 Solution should have crawler module to perform remote scanning in MS SharePoint and MS Exchange instances 6.7 Solution should be able to perform OCR recognition for analyzed files 6.8 Solution should be able to delete violated files from disc on specific workstation and create incident profile in system repository with copy of the original file.Solution should be able to extract text data and perform content analysis from files following types: HTML, MHT, CHM, XML, PDF, TXT, DOC, DOCX, RTF, PPT, PPTX, XLS, XLSX, XLSB, EML, MPP, MSG, ODB, ODF, ODG, ODP, ODS, ODT, PST, TNEF, WPS, WRI, CDW, FRW, M3D 2.2.Solution should have unified policy server with the following content analysis algorithms and techniques:
• Dictionaries with keywords, also using wildcards (*, ?, ^, !, #, @)
• Sets of customizable regular expressions and templates (credit cards, user SSN, etc.)
• Digital fingerprint for the following entities: o Documents with the text content o Pictures and images o Set of target rows of source database
• Bayesian probabilistic analysis method with dictionaries
• Support Vector machine learning algorithm.- Place and block violator object in system mail quarantine
• Send customizable notification over SMTP mail service
• Push user notification alert in system tray in workstation
• Remove violator object from mail body
• Remove violator object from workstation
• Create incident in event log instance
• Write data to Syslog
• Encrypt copied file
• Create snapshot of user's workspace in active OS session
• Create snapshot of web camera on user's PC
• Assign specific status label to the selected user
• Add Data Class
• Active windows session logoff on target PC for the user with the following options: o Repeated logon is impossible (logon blocking) o Block user account in domain active directory with specified duration.Solution should be able to extract text data and perform content analysis from archive files following types: 7z, ARC, ARJ, bzip2, CAB, gzip, ISO, RAR, tar, ZIP 2.3.Detailed requirements for data classification and categorization module 2.1.2.3.4.5.6.7.

1. 
   

   General requirements and design principles
   1.1 Solution should be composed the following modules:
   ­ Policy server
   ­ Web-portal reporting module
   ­ Repository server
   ­ Endpoint DLP agent module
   ­ Deployment server
   ­ Log server
   ­ OCR server module.
   1.2 Solution should have unified policy server where all system policy with filtering and verification rules, data classification methods and verification algorithms will be stored
   1.3 Solution should have unified repository server to gather and retain all incidents from all monitored channels and users workstation with system attributes and shadow copy of original violated file or document
   1.4 Solution should have unified DLP management web console for system officers and administrators to perform policy violation cases investigations, settings management and policies customization for all DLP modules and components
   1.5 Solution should allow system officers and administrators to manage all settings and get access to incidents repository over unified DLP management web console
   1.6 Solution should be able to collect and retain all incidents in one single database in system repository server based on RDBMS MS SQL Server 2019 and any later or PostgreSQL 9.6/10 or above
   1.7 Solution should have unified single log server to log and store all system logs from other system servers and modules
   1.8 Solution should have single deployment management server module to manage endpoint agents deployment
   1.9 Solution should be able to deploy all server modules and components on single server instance with Microsoft Windows Server 2008R2/2012/2012R2/16/19/22 (x64) and Ubuntu Linux LTS 22.04.
   1.10 Solution should be able to deploy agent module in the following OS:
   ­ Windows XPSP3/7/8/8.1/10 (x64), Windows Server 2008R2/2012/2012R2/16/19/22 (x64)
   ­ Ubuntu Linux LTS 18.04\20.04\22.04.
   1.11 Solution should be able to launch DLP management web console in Google Chrome
   1.12 Solution should be able to use Single Sign-On option in DLP management web console for system officers and administrators based on their credentials from MS Active Directory.

   
   


2. 
   

   Detailed requirements for data classification and categorization module
   2.1. Solution should be able to extract text data and perform content analysis from files following types: HTML, MHT, CHM, XML, PDF, TXT, DOC, DOCX, RTF, PPT, PPTX, XLS, XLSX, XLSB, EML, MPP, MSG, ODB, ODF, ODG, ODP, ODS, ODT, PST, TNEF, WPS, WRI, CDW, FRW, M3D
   2.2. Solution should be able to extract text data and perform content analysis from archive files following types: 7z, ARC, ARJ, bzip2, CAB, gzip, ISO, RAR, tar, ZIP
   2.3. Solution should have unified policy server with the following content analysis algorithms and techniques:
   ­ Dictionaries with keywords, also using wildcards (*, ?, ^, !, #, @)
   ­ Sets of customizable regular expressions and templates (credit cards, user SSN, etc.)
   ­ Digital fingerprint for the following entities:
   o Documents with the text content
   o Pictures and images
   o Set of target rows of source database
   ­ Bayesian probabilistic analysis method with dictionaries
   ­ Support Vector machine learning algorithm.

   
   


3. 
   

   Detailed requirements for policy server module
   3.1 Solution should have unified single policy server with the following policy creation schema: Selected Channel – Scope of verification rules – Auto executable system action
   3.2 Solution should have single DLP management modern look web console for system officers and administrators to perform policy customization in policy creation wizard
   3.3 Policy server should be able to implement particular policy to all or the following selected channels: Web Internet, SMTP mail, Instant Messengers, Printers, Removable devices, Clipboard, Keyboard on Workstation, Screen in workstation, Microphone in workstation, Web camera in workstation and Discovery crawler
   3.4 Solution should be able to setup in policy creation wizard the following verification rules:
   ­ Incident attributes verification (User name, IP address, host name, file size, channel, recipient name, sender name, file text, body text, device name, incident type, web service, process, document metadata properties, current user’s UBA index, user status, triggered policy, amount of printed pages, user belong to specific domain etc.)
   ­ Verification using particular digital fingerprints
   ­ Verification using particular dictionaries
   ­ File type verification (text, graphic, audio, video, archive, executable, encrypted data, unknown type)
   3.5 Solution should be able to setup in policy creation wizard the following auto executable system actions:
   ­ Create incident in system repository with the following attributes:
   o Incident severity (high, medium or low)
   o Assign specific label to the incident
   o Assign customizable risk score value.
   ­ Place and block violator object in system mail quarantine
   ­ Send customizable notification over SMTP mail service
   ­ Push user notification alert in system tray in workstation
   ­ Remove violator object from mail body
   ­ Remove violator object from workstation
   ­ Create incident in event log instance
   ­ Write data to Syslog
   ­ Encrypt copied file
   ­ Create snapshot of user’s workspace in active OS session
   ­ Create snapshot of web camera on user’s PC
   ­ Assign specific status label to the selected user
   ­ Add Data Class
   ­ Active windows session logoff on target PC for the user with the following options:
   o Repeated logon is impossible (logon blocking)
   o Block user account in domain active directory with specified duration.
   ­ Block printscreen operation in workstation for specific application launched
   ­ Add customizable watermark on top of specific application launched
   
   ­ Stop verification process for this particular object
   ­ Cancel previous operations.
   3.6 Solution should have the following specific engines for data mining and analysis to perform the following:
   ­ User behavior analysis (UBA) model
   ­ Risk Assessment model.
   3.7 Solution should be able to setup and launch customizable alerting notification in system tray in MS Windows OS for user in case of particular policy violation
   3.8 Solution should be able to capture MS Office documents metadata: author, organization name, subject, title, categories, comments etc.
   3.9 Solution should be able to setup “Data class” attribute for captured files and documents based on data classification methods.
   3.10 Solution should be able to capture from documents and check TITUS tags
   3.11 Solution should be able to use in policy verification condition current daily UBA indicator for particular user
   3.12 Solution should be able to copy existing policy
   3.13 Solution should be able to setup duration period for particular policy and execution schedule (once, daily, weekly etc.)
   3.14 Solution should be able to use as verification condition other policies that that was used on earlier verification steps for this particular object
   3.15 Solution should be able to capture text from file combined from several binary objects with text
   3.16 Solution should be able to setup required level of nested levels in archive file for data capturing
   3.17 Solution should be able to perform backup export of all system settings data to structured file
   3.18 Solution should be able to write incidents to SIEM instance using UDP and TCP protocol with the following protocols: CEF, LEEF, BSD syslog (RFC 3164), Syslog (RFC 5424)
   3.19 Solution should be able to protect endpoint agent module against uninstallation in Programs and features console on workstation
   3.20 Solution should be able to setup customizable uninstall password for agent module in Programs and features console on workstation
   3.21 Solution should be able to perform hiding endpoint agent signs in the following in MS Windows consoles:
   ­ Agent processes in “Task manager” console
   ­ Entry in “Programs and features” console
   ­ Entry in “System services” console
   ­ File Explorer of OS.
   3.22 Solution should provide endpoint agent launch in secure boot in MS Windows on workstation
   3.23 Solution should be able to receive incidents and perform data sharing with workstations, which are not included in corporate MS Active Directory domain
   3.24 Solution should be able export list of workstations where DLP agent is installed with the following details: host name and IP, DLP modules version, last synchronization date\time, policies and configuration settings
   3.25 Solution should be able to open live monitoring session in management web console for particular workstation and user with the following options:
   ­ User’s workspace live monitoring session
   ­ Making snapshots form the local web camera.
   3.26 Solution should be able on occurrence of triggered system events push notification system messages to security administrator in Telegram messenger.

   
   


4. 
   

   Detailed requirements for Traffic Control module
   4.1 Solution should be able to capture mail traffic both at mail server and at endpoint agent module
   4.2 Solution should be able to capture SMTP, IMAP, POP3 mail traffic
   4.3 Solution should be able to receive and analyze outgoing and incoming SMTP mail traffic from corporate SMTP mail servers
   4.4 Solution should be able to control internal mail traffic from internal users on MS Exchange server 2007/2010/2013/2016
   4.5 Solution should be able to install DLP interceptor plugin module on MS Exchange server 2007/2010/2013/2016
   4.6 Solution should be able to receive over POP3 and HTTPS protocols mirrored mail traffic from operate mail SMTP server
   4.7 Solution should be able to block mail in system mail quarantine
   4.8 Solution should be able to install mail interceptor plugin module in Microsoft Outlook 2007/2010/2013/2016 and Mozilla Thunderbird at user’s workstation
   4.9 Solution should be able to capture HTTP/HTTPS traffic both at operational web-gateway module over ICAP protocol and at endpoint agent module
   4.10 Solution should be able to decrypt and capture https traffic at endpoint using man in the middle (MITM) algorithm
   4.11 Solution should be able to decrypt and capture https traffic at endpoint using deep API integration with the following browsers: Chrome, IE 8+, Firefox, Opera and Edge
   4.12 Solution should be able to block web traffic in browser level using deep API integration without MITM tools
   4.13 Solution should be able to capture FTP traffic
   4.14 Solution should be able to capture the traffic from the following list of public web services: Gmail, Yahoo Mail, Google Docs, Office 365, OneDrive, Google Search, Facebook, Dropbox, LinkedIn, Live Journal, Twitter, YouTube, Deposit files etc.
   4.15 Solution should be able to capture the traffic from Outlook Web App
   4.16 Solution should be able to capture and log instant messenger traffic for the following messengers: WhatsApp, Telegram, ICQ, Skype, Viber and Jabber
   4.17 Solution should be able to capture and block the following objects from WhatsApp thick client traffic flow: text chat messages and attached files
   4.18 Solution should be able to capture and block the following objects from Telegram thick client traffic flow: text chat messages, attached files, audio records of voice session
   4.19 Solution should be able to decrypt, capture and block instant messenger traffic from WhatsApp web service and Telegram web service opened in web browser on workstation
   4.20 Solution should be able to decrypt, capture and log the following traffic from Skype application: text chat messages, attached files, audio records of voice session
   4.21 Solution should be able to block launch of Skype application at user’s workstation
   4.22 Solution should be able to block file transfer via Skype application at user’s workstation
   4.23 Solution should be able to capture and log the following traffic from MS Teams desktop and Web Teams application: text chat messages, attached files, audio records of voice session
   4.24 Solution should be able to setup the list of the applications whose internet traffic is processed by the endpoint DLP agent
   4.25 Solution should be able to setup the list of the applications whose internet traffic is ignored by the endpoint DLP agent
   4.26 Solution should be able to setup the lists of applications whose internet traffic should and should not be controlled or blocked by the agent
   4.27 Solution should be able to setup the list of the applications that are allowed to establish incoming\outgoing connections
   4.28 Solution should be able to setup the list of the applications whose incoming\outgoing connections are blocked
   4.29 Solution should be able to setup the list of the hosts whose incoming and outgoing SSL traffic is not decrypted and not analyzed
   4.30 Solution should be able to specify when the agent controls traffic on endpoint agent:
   ­ Corp domain available locally: the computer is connected to the local network
   ­ Corp domain available via VPN: the computer is connected to the domain via VPN
   ­ Corp domain unavailable: there is no active connection between the workstation and corp domain.
   4.31 Solution should be able to customize the name of trusted certificate in user’s web browser using SSL decryption with man in the middle (MITM) algorithm.

   
   


5. 
   

   Detailed requirements for Device Control module
   5.1 Solution should be able to setup access control list (ACL) for particular peripheral and removable devices based on set of active policies for specific user
   5.2 Solution should be able to setup access control list (ACL) for particular peripheral and removable devices (USB devices, Removable media etc) for the specific user with the following access rights: Full Access, Reading, Writing
   5.3 Solution should be able to perform file operations control with peripheral and removable devices based on set of active policies for specific user
   5.4 Solution should be able to perform file content analysis for file and document on peripheral and removable devices based on set of active policies for specific user
   5.5 Solution should be able to perform control and block file operations with files in peripheral and removable USB devices based on the following policy verification rules: file attributes, document text digital fingerprints, content analysis with dictionaries and file types
   5.6 Solution should be able to capture and create shadow copy for all violated files and documents
   5.7 Solution should be able to perform control of printing operations and block file printing on printer devices based on the following policy verification rules: file attributes, document text digital fingerprints, content analysis with dictionaries and file types
   5.8 Solution should have the following list of built-in device types classification for the use in device control policy creator wizard:
   ­ Typical device classes: USB devices, network devices, DVD/CD drives, removable media, printers, hard drives, PCMCAI adapters, modems, IrDA etc.
   ­ Physical device classes: storage controllers, Bluetooth, portable devices, tape drives, smart card readers, IEEE devices etc.
   5.9 Solution should be able to use in policies verification rules attributes based on particular device characteristics: serial number, model code, class, device type etc.
   5.10 Solution should be able to perform control and block file operations with files in peripheral and removable devices connected over MTP protocol
   5.11 Solution should be able to manage size of the local storage of logs and shadow copies on endpoints
   5.12 Solution should be able to perform selective file encryption to a USB removable device based on the contents analysis permission or file type of the copied file for particular policy
   5.13 Solution should be able to perform files decryption only on workstations with installed endpoint DLP module
   5.14 Solution should be able to capture microphone record from user workstation based on policies
   5.15 Solution should be able to capture keystrokes from keyboard on user workstation
   5.16 Solution should be able to capture photos from web-camera on user’s workstation
   5.17 Solution should be able to launch live monitoring session of user’s workspace in active OS session by command from officer
   5.18 Solution should be able to create snapshot of web-camera on user’s PC by command from officer
   5.19 Solution should be able to add customizable watermark in user’s workspace on top of specific application launched in workstation
   5.20 Solution should be able to add customizable text to the watermark for specific application or groups of applications
   5.21 Solution should be able to block print screen operation in workstation for specific application launched
   5.22 Solution should have application launch control module at endpoint to log and block EXE file execution on workstation
   5.23 Solution should be able to create and apply new category in the launch control policies with customized group of applications
   5.24 Solution should be able to create new application entity with file path to its EXE or CRC fingerprint of target EXE file
   5.25 Solution should be able to capture screenshots of workspace from user workstation (PNG and JPG file formats)
   5.26 Solution should be able to process request from the user to obtain advanced access within the current set of local policies by means of the following methods:
   ­ Request to the system administrator over email
   ­ Unique code ID sharing and confirmation response code ID from system administrator over telephone.
   5.27 Solution should be able to perform analysis with OCR recognition for copied files.

   
   


6. 
   

   Detailed requirements for Discovery Control module
   6.1 Solution should be able to perform files scanning on workstations with installed endpoint DLP module in live mode or based on the schedule
   6.2 Solution should be able to capture and create shadow copy for all violated files and documents
   6.3 Solution should be able to perform scanning based on the following policy verification rules: file attributes, document text digital fingerprints, content analysis with dictionaries and file types
   6.4 Solution should be able to setup target scope of folder on workstations that would not be scanned
   6.5 Solution should have crawler module to perform remote scanning in shared folders on the file server
   6.6 Solution should have crawler module to perform remote scanning in MS SharePoint and MS Exchange instances
   6.7 Solution should be able to perform OCR recognition for analyzed files
   6.8 Solution should be able to delete violated files from disc on specific workstation and create incident profile in system repository with copy of the original file.

   
   


7. 
   

   Detailed requirements for reports module and management console
   7.1 Solution should have customizable operator’s workspace with Homepage
   7.2 Solution should be able to create private customizable sets of widgets on workspace
   7.3 Solution should be able to setup in management console “Dark Style” mode for operator’s eye saving.
   7.4 Solution should be able to create unified personal profile for each monitored person with the following sections:
   ­ General user summary section and his statuses (risk level index, productivity and activity index etc)
   ­ Summary of Incidents, channels and policies
   ­ Behavior analysis (UBA) summary
   ­ Risk assessment summary (general risk rate, average daily risk index, dynamicс diagram for the month etc.)
   ­ Diagram of user’s relations and connections
   ­ User’s emotional state
   ­ User’s profiles and anomalies
   ­ Summary of working time
   ­ User summary and his known aliases (emails, messengers, social network accounts etc.)
   ­ All data and events.
   7.5 Solution should be able to perform risk assessment and analysis
   7.6 Solution should be able to calculate daily risk scores for last month
   7.7 Solution should be able to calculate daily risk score dynamic for last month
   7.8 Solution should be able to create visualized drill-down Connection Diagram for user’s collaboration over network channels based on captured historical data from repository
   7.9 Solution should be able to calculate composite everyday indicator of user behavior using built-in user behavior analysis (UBA) engine
   7.10 Solution should be able perform analysis and alerting for the following anomalies in user’s behavior:
   ­ Communications with the unknown recipients
   ­ The first time usage of the device
   ­ First remote connection to the PC
   ­ Attendance on weekends and holidays
   ­ Increased activity compared to the company average
   ­ Increased activity compared to the department average
   ­ Increased popularity compared to the company average
   ­ New employee
   ­ Absence for more than 40 days
   ­ Employee ego network is larger than the company average
   ­ Number of employee accounts is greater than the company average
   ­ Using more than one social network or messenger account.
   7.11 UBA indicator should be calculated based on the following key factors for particular employee:
   ­ number of incidents and violations
   ­ volume of traffic
   ­ number of new incidents files founded on workstation
   ­ number and volume of files being sent
   ­ Incident size.
   7.12 Solution should be able to calculate the level of user’s normal behavior based on historical data from DB repository
   7.13 Solution should be able to compare current UBA rates with historical data for previous period
   
   7.14 Solution should be able to calculate daily user’s emotional state composite indicators based on captured traffic and events from monitored users
   7.15 Emotional mood composite indicator should contain the following sub-indexes determinants the rates of employee’s emotional health: joy, trust, surprise, anticipation, sadness, disgust, fear, anger
   7.16 Solution should be able to assign customized status labels for specific user
   7.17 Solution should be able to manually add new users linked account or aliases (Messengers, social networks etc) for specific user in his system profile
   7.18 Solution should be able to create aggregated feed-like view of events and incidents for this particular user
   7.19 Solution should be able to create unified chat-like report displaying dialogue between two selected persons
   7.20 Solution should be able to create customizable reports with filtering options for rows based on logical operator OR, AND, NOT
   7.21 Solution should have unified incident profile with the following sections: key attributes, detailed system verification log, section with shadow copy
   7.22 Solution should have preview section for incident profiles in management console
   7.23 Solution should be able to assign customized labels for specific incident
   7.24 Solution should be able to add, edit or delete custom users text comment in particular incident profile
   7.25 Solution should be able to compare persons and organization units in one unified structured table with the following respects: risk score, amount of incidents and other
   7.26 Solution should be able to create customizable reports with charts and diagrams (linear, pie etc.)
   7.27 Solution should be able to launch live monitoring session of user’s workspace in active OS session by command from officer in management console
   7.28 Solution should be able to create snapshot of web-camera on user’s PC by command from officer in management console
   7.29 Solution should be able to export reports or selected rows from report to expropriated HTML file for autonomous review by manager or officer
   7.30 Solution should be able to export reports or selected rows from report to XLSX, CSV, PST and PDF file formats
   7.31 Solution should be able to export the set of captured user’s workspace screenshots to video media file
   7.32 Solution should have in web console customizable web reports adapted for big data displaying (up to ten of thousand records)
   7.33 Solution should be able to setup system scheduled tasks:
   ­ Delete group of incidents with specified parameters (Severity, Status, Type etc.)
   ­ Send selected reports to the target recipients
   ­ Apply new policies to selected group of existing incidents in database.
   7.34 Solution should be able to ensure case management process for group of officers (incident response platform IRP)
   7.35 Solution should be able to create templates for various cases with customizable task profile
   7.36 Solution should be able to link incident profiles and task profile
   7.37 Solution should be able to run the workflow process with the following statuses: new, in progress, in review, closed
   7.38 Solution should be able to push notifications to executor of selected task in case of exceeding the stage time limits
   7.39 Solution should be able to perform selective customizable access for specific users or groups to the following sections and settings in DLP management web console GUI:
   ­ mail quarantine section
   ­ employee profiles section
   ­ Task manager section
   ­ New reports creation section
   ­ User’s access control list configuration section
   ­ User behavior analysis engine settings section
   ­ System archive databases settings section
   ­ Widgets on workspace.
   7.40 Solution should be able to setup selective access control mode to accessible sections in management web console for specific users or groups: full access, view only, access denied
   7.41 Solution should be able to setup selective access control mode for specific reports in management web console for specific users or groups: full access, view including subreports, view without subreports
   7.42 Solution should be able to setup selective access control mode to widgets in management web console for specific users or groups: full access, view only, access denied
   7.43 Solution should be able to hide specific widgets for specific user
   7.44 Solution should be able to show specific widgets only for specific user
   7.45 Solution should be able to setup permission access to particular archive database repository in DLP management web console.

   
   


8. 
   

   Detailed requirements for DLP agent deployment module
   8.1 Solution should have unified single agent endpoint deployment server
   8.2 Solution should be able to setup deployment task the following types:
   ­ Endpoint module Installation
   ­ Endpoint module repair procedure
   ­ Delete endpoint module.
   8.3 Solution should be able to setup scheduled installation tasks, specifying the following parameters: distributive package release version, task execution time, list of target workstations and other parameters
   8.4 Solution should be able to setup time schedule for launching tasks: permanent, run once with date\time, daily, weekly, monthly etc.
   8.5 Solution should be able to setup in tasks distribution list of target workstations in corp MS Active Directory domain and other stand-alone workstations which are not included in corporate domain
   8.6 Solution should be able to setup in the active task IP of target domain-less workstation as well as range of IPs
   8.7 Solution should be able to load target workstation IP from structured file
   8.8 Solution should be able to apply workstation restarting after endpoint agent installation automatically
   8.9 Solution should be able to collect and store detailed task status log
   8.10 Solution should be able to collect and store detailed installation log for target workstations
   
   8.11 Solution should be able to setup central library of endpoint installation packages releases.

   
   


9. 
   

   Detailed requirements for OCR module [required additional license]
   9.1 Solution should have unified single OCR server module for capturing text data from files and documents
   9.2 Solution should have built-in OCR engine integration scheme for Abbyy FineReader and Google Tesseract OCR engine
   9.3 Solution should be able to setup range of permitted workstation IP address for receiving request for recognition
   9.4 Solution should be able to setup limit of recognition threads.

   
   


10. 
    

    Detailed requirements for Screen Photo Detector module [required additional license]
    10.1 Solution should be able to detect users attempts to take the photos of the screen using smartphones
    10.2 Solution should be able to analyze web camera snapshots at endpoint in live mode
    10.3 Solution should be able to recognize image of smartphones on snapshots
    10.4 Solution should have neural network to perform recognition of image of smartphones
    10.5 Solution should have incident profile with the following attributes:
    ­ Captured web camera snapshots
    ­ User name and hostname
    ­ User workspace snapshot.

    
    


11. 
    

    Detailed requirements for Staff Control module [required additional license]
    11.1 Solution should be able to monitor user’s working hours activity in workstation in Windows OS and Ubuntu OS
    11.2 Solution should be able to classify user’s captured working hours activity for the specified period with the following types:
    ­ Productive time
    ­ Inappropriate use of PC
    ­ Not defined
    ­ Inactivity
    ­ Away from PC
    11.3 Solution should be able to calculate active time on the PC only in case when user is working with the keyboard or moving the mouse pointer and clicking the mouse buttons
    11.4 Solution should be able to calculate Inactivity time as the absence of user activity while the PC is switched on and not locked
    11.5 Solution should be able to calculate Away from PC time when the computer is locked, or the computer screen is inactive (the screensaver is active)
    11.6 Solution should be able to setup working days, holidays and working hours specified for the employees.
    11.7 Solution should be able to calculate the following personal indicators and time estimations for the monitored employee:
    ­ Productivity indicator. It calculates time employee actively using the productive applications and websites in relation to the total time at the PC
    ­ Productive time indicator. It calculates time employee actively using the productive applications and websites
    ­ Inappropriate usage indicator. It calculates time employee spent on the computer using the unproductive applications and websites.
    ­ Not defined time. It calculates time employee spent on the computer using the applications and websites whose productivity is not defined.
    
    ­ Time at the PC. It calculates total employee time from the time of the first system logon to the time of the last logout for the day, less the following time periods:
    • when the user was blocked (the user logged out or blocked the session);
    • when the computer screen was inactive.
    ­ Active time at the PC. It calculates employee time spent at the PC, less the time of inactivity
    ­ Away from the PC time. It calculates total employee time from the time of the first system logon to the time of the last logout for the day, during which:
    
    • User was blocked (the user logged out or blocked the session),
    • Computer screen was inactive.

    
    

­ Average time at the office. It calculates average employee time at work on the days when the employee was at the office or worked remotely (the summarized time at the office for the selected time period divided by the number of days worked).
­ Time at the office. It calculates total employee time from the time of the first system logon to the time of the last logout for the day.
­ Away from the office. It calculates the summarized employee time of late arrivals and early departures at the same time (early arrivals and late departures are not taken into account).

­ Worked days. It calculates number of working days when the employee was at the office or worked remotely.
­ Remote work time. It calculates time employee spent at the PC remotely via remote RDP connection.
­ Absence days. It calculates number of working days when the employee was away from the office and did not work remotely.
­ Late arrivals. The number of late arrivals for the selected period.
­ Early departures. The number of early departures for the selected period.
11.8 Solution should be able to calculate activity in certain websites and applications that are related to the employee’s activities
11.9 Solution should be able to calculate employee’s activity with the following parameters:
­ Application or websites specified category
­ Calculated time usage
­ Percentage index. In relation to the total time spent in applications and on websites
­ Percentage change. In relation to the identical preceding time period for the given employee.
11.10 Solution should be able to setup group of productive and unproductive application and website categories for the employees.
11.11 Solution should be able to upload the pre-installed list of default categories containing the most popular websites and applications
11.12 Solution should be able to calculate employee’s timesheets for the dates when the employee was present at work with the following parameters:
­ Time of Arrival to work. Parameter is defined as the time when the employee first logged in the system or unlocked the PC.
­ Time of departure from work. Parameter is defined as the time when the employee last logged out of the system or locked the PC for the day.
­ Time spent at work. This parameter is equal to the difference between the Arrival to work and Departure from work indicators for the day.
11.13 Solution should be able to create the following type of advanced reports and user’s timesheets:
­ Structured timesheet for selected employees for the last or specified month
­ Working hours general reports
­ Application and websites usage summary report (activity time, percentage of time at PC).