Forcepoint DLP backup

Forcepoint DLP backup

How do I back up and restore Forcepoint DLP?
Backup and Restore | Forcepoint DLP | 29-Apr-2022
Back up your Forcepoint DLP system periodically to safeguard your policies, forensics, configuration data, fingerprints, encryption keys, and more.
Configuring and running the Forcepoint DLP backup task
To configure the Forcepoint DLP backup process:
1.
Log on to the Forcepoint Security Manager and go to the Data > Settings > General > Backup page.
2.
Enter a Path for storing backup files and, if necessary, Credentials for an account with read, write, and delete privileges to the path. The path must be in UNC format. C: is the default location for storing backups.
3.
Enter a value between 1 and 60 in the How many backup copies do you want to keep? field to specify how many separate backups to maintain (5, by default).
Each backup is stored in a separate folder. When the maximum number of copies is reached, Forcepoint DLP reuses the oldest folder, overwriting the previous information.
4.
Indicate whether or not to include forensics in the backup.
5.
Click OK to save the settings.
Schedule backups when the system isn't under significant load. Each backup contains a complete snapshot of the system. The process collects needed information from other Forcepoint DLP machines.
To schedule the backup task:
1.
On the Forcepoint management server, open the Windows Task Scheduler.
2.
In the Task Scheduler window, select Task Scheduler Library.
3.
Right-click the Websense TRITON AP-DATA Backup task and select Enable.
4.
Right-click Websense TRITON AP-DATA Backup again and select Properties, then select the Triggers tab.
5.
Click Edit, and edit the schedule as required.
6.
Click OK twice.
If requested, enter a management server administrator password to confirm the changes to the task.
To run the task immediately, right-click Websense TRITON AP-DATA Backup and select Run. Running this task creates a DSSBackup folder and a time stamp folder in the destination folder you specified. For example: \DSSBackup\2-6-2016-2-10-35-AM, where the numbers stand for the month, day, year, hour, minutes, and seconds.
The DSSBackup folder includes these items:
\certs: Certificate
\crawlers: Crawler jobs information
\forensics_repository: Forensics
\MngDB: DSS SQL DB (wbsn-data-security)
\PreciseID_DB: Fingerprinting repository + FPNEs
Backup.text: DSS version
DataBackup.log: Backup log
Ep-profile-keys.zip: Endpoint encryption keys (configured in the profile)
Subscription .xml: License file
\ResourceRepositoryCache + \ResourceRepositoryCachedXmls: Cached resources
Restoring your Forcepoint DLP configuration
1.
Make sure all Forcepoint DLP modules—servers, agents, protectors—are registered with the Forcepoint management server and the system is operating normally.
2.
On the management server, open the Windows Control Panel and select Programs > Uninstall a program.
3.
Select Forcepoint DLP, then click Uninstall/Change.
4.
When asked if you want to add, remove, or modify Forcepoint DLP, select Modify.
5.
Click Next until you get to the Restore Data from Backup screen.
 
 
Note 
Backups must be enabled in order to restore a backup from another DLP management server. See the DLP installation guide for instructions.
6.
Select the Load Data From Backup check box and click the Browse button to locate the backup file.
7.
Select the Clear Forensics since last backup check box if you want to use only the stored forensics from your backup file; this will remove all forensics gained since the last backup. (Leaving it unchecked means that your forensics data after the restore will include the backed-up forensics and the forensics added since that backup.)
8.
Click Next until you begin the restore procedure.
During the restore process, a command-line window appears; it may remain for some time, but it disappears when the recovery is complete.
The restore operation completely erases all policies and data (and, if checked, forensics) of the current system, and replaces them with the backed-up data.
9.
Complete the restore wizard.
10.
To review the restore activity, read the DataRestore.log file located in the backup folder (for example, MM-DD-YYYY-HH-MM-SS).
11.
Log onto the Data Security module of the Forcepoint Security Manager.
12.
To enable your crawlers to work with the newest encryption keys, open each discovery, fingerprint, and machine learning task in your system and edit it in some way, even just the description.
If you have Box discovery tasks, edit them and enter your Box credentials again.
If your fingerprint tasks were configured to be exported to a machine with credentials, edit them and reenter the machine credentials.
13.
Select Deploy.
 
 
Note 
If the backup system contains many policies, it may take a while to load the policies and deploy them.