Justifications can be used with prevention rules to give users the option to continue a prevented action by selecting a response. Once a justification is selected, the action is allowed.
Justifications are defined for endpoint notifications and can be configured at both the Agent Realm level and the Prevention Rule level. To enable justifications, End User Notifications must be enabled in the Advanced Settings of the Agent Realm.
The default justification is set up at the Agent Realm level in the end user notification.
You can define justifications at the rule level. By creating a notification policy and assigning it to specific prevention rules, you can override the default notification set at the Agent Realm level. (If you do not set up notifications at the rule level, the Agent Realm notifications are used as the default.)
See Notification for Endpoint Activities.
Rule Level Justifications
You can set up a notification with justification at the rule level. In that case, the user is prompted for the justification when the action that is defined in the rule occurs.
You can select :
-
Prompt the user to provide a justification and the default justification you defined for the Agent Realm will be used.
-
Block and assign the end user notification that includes a customized justification you want to use.
Related Topic:
ITM / Endpoint DLP Prevention Rules