Network Implementation Guide › Applying User Policy to NBA Events › User Policy Changes › Available Control Actions

Available Control Actions

The range of available control actions depends on the NBA output mode:

Output to socket

When the NBA outputs items via a socket connection, you can block unauthorized e‑mails, IM comments or files using Outgoing Email and Data In Motion control actions.

if a trigger fires and the control action is set to ‘block’ but the NBA application filter is set to 'monitor' or the NBA is in passive mode, the item is allowed to continue through the NBA without interruption.

You can also configure control actions to quarantine emails, or to categorize or apply smart tags to the resulting email or file events stored on the CMS.

However, you cannot use the ‘Warn’ or ‘Inform’ options provided with these control actions; these options are not supported for NBA events. ‘Warn’ or ‘Inform’ options can only be applied to events captured by CA DLP email agents and CA DLP file agents for client machines.

If you want to save a copy of the email or file, you must also specify a capture action—see below.

Output to disk

If the NBA runs in passive mode and outputs items to disk, you can only categorize, or apply smart tags to, imported events. If you want to save a copy of the associated email, IM conversation or file, you also need to specify a capture action.

More information:

How Does the NBA Block Events?

Quarantined Emails

Available Capture Actions