Create user instructions templates

Create and manage user instructions template for DLP incidents to help the users understand the instructions involved incident resolution and the next steps involved in the resolution process.

Before you begin

The user instructions card template displays two different headers which provides you more information about a specific incident on the form view.

Role required:

sn_dlir.admin - Create, edit, and delete.
sn_dlir.analyst and sn_dlir.analyst_read - View (read-only).

About this task

When an incident is assigned to the end user then the user might be required to know the additional instructions on how to respond to the incidents, introduce the users to the terminology and provide any additional information about the incident. These templates can guide the users to provide the accurate response to the DLP incidents.

Procedure

Navigate to All > DLP Administration > User Instructions Templates.
Click New.
On the form, fill in the fields.

Field	Description
Name	Name of the user instruction template.
Short Description	Unique description of this user instruction template.
Active	Option to indicate whether the user instruction template is active.
Execution Order	Priority of the incident user instruction template. This field indicates the order in which the order is executed to evaluate the user instruction template when an incident is created.The option with the lowest number has the highest priority. To set the order of operation, enter a value. For example, 100, 200, or any other number. The default is 100.
Incidents matching condition	Incidents that match the defined conditions in the condition builder will be displayed.These conditions are based on the DLP incident data. To build a condition for a user instruction, select any of the incident fields. Use the lists and fields of the conditions builder to set the filters for the first row. To add more conditions, click AND or OR: If AND is selected, all conditions must be matched. If OR is selected, either condition can be matched. To set a second filter condition, click New Criteria.Note: The conditions in the condition builder are case sensitive.
Applies to	Select the user or user groups that the template is applicable for. The other available options are:- All end users: Select this check box if the instructions template applies to all the users. - All reviewers of escalated incidents: Select this check box if the template applies to all the reviewers of the escalated incidents. - Specific users: Click the icon to add a particular user from the list to whom the DLP incident conditions are applicable. You can also add a user by using their email address or search option. For example, Legal Manager. To add yourself as the user to whom the DLP conditions are applicable, click the Add me icon. Specific user groups: Click the icon to add a particular group from the list to whom the DLP incident conditions are applicable. You can also add a group by using the search option. For example, Survey creators.
Instructions Template: Instructions	Add instructions in the rich text editor with variables available at an incident level.

Drill down to the Instructions Template section, enter the template instruction and add incident level information under this section, if required.
Drag-and-drop the required variables to dynamically display certain fields.
Click Submit.

The user instructions templates are now created and you can click on any user instruction header to know the additional details of a DLP incident.

For more information, see Data Loss Prevention Incident Response User Workspace.
Configure DLP UI user instructions
Configure the system UI messages to add detailed user instruction headers as required.

Parent Topic:DLP Incident Response Administration

Related topics

DLP default configuration settings

Create end user lookup rules

Create assignment rules

Create incident consolidation rules

Create response due date rules

Create Approval Rules

Create email templates

Create a Data Loss Prevention Incident Response SLA trigger

Create a Data Loss Prevention Incident Response SLA definition

Create assessments