Forcepoint DLP backup

How do I back up and restore Forcepoint DLP?

Backup and Restore | Forcepoint DLP | 29-Apr-2022

Back up your Forcepoint DLP system periodically to safeguard your policies, forensics, configuration data, fingerprints, encryption keys, and more.

Configuring and running the Forcepoint DLP backup task

To configure the Forcepoint DLP backup process:

1.	Log on to the Forcepoint Security Manager and go to the Data > Settings > General > Backup page.

2.	Enter a Path for storing backup files and, if necessary, Credentials for an account with read, write, and delete privileges to the path. The path must be in UNC format. C: is the default location for storing backups.

3.	Enter a value between 1 and 60 in the How many backup copies do you want to keep? field to specify how many separate backups to maintain (5, by default).

Each backup is stored in a separate folder. When the maximum number of copies is reached, Forcepoint DLP reuses the oldest folder, overwriting the previous information.

4.	Indicate whether or not to include forensics in the backup.

5.	Click OK to save the settings.

Schedule backups when the system isn't under significant load. Each backup contains a complete snapshot of the system. The process collects needed information from other Forcepoint DLP machines.

To schedule the backup task:

1.	On the Forcepoint management server, open the Windows Task Scheduler.

2.	In the Task Scheduler window, select Task Scheduler Library.

3.	Right-click the Websense TRITON AP-DATA Backup task and select Enable.

4.	Right-click Websense TRITON AP-DATA Backup again and select Properties, then select the Triggers tab.

5.	Click Edit, and edit the schedule as required.

6.	Click OK twice.

If requested, enter a management server administrator password to confirm the changes to the task.

To run the task immediately, right-click Websense TRITON AP-DATA Backup and select Run. Running this task creates a DSSBackup folder and a time stamp folder in the destination folder you specified. For example: \DSSBackup\2-6-2016-2-10-35-AM, where the numbers stand for the month, day, year, hour, minutes, and seconds.

The DSSBackup folder includes these items:

\certs: Certificate

\crawlers: Crawler jobs information

\forensics_repository: Forensics

\MngDB: DSS SQL DB (wbsn-data-security)

\PreciseID_DB: Fingerprinting repository + FPNEs

Backup.text: DSS version

DataBackup.log: Backup log

Ep-profile-keys.zip: Endpoint encryption keys (configured in the profile)

Subscription .xml: License file

\ResourceRepositoryCache + \ResourceRepositoryCachedXmls: Cached resources

Restoring your Forcepoint DLP configuration

1.	Make sure all Forcepoint DLP modules—servers, agents, protectors—are registered with the Forcepoint management server and the system is operating normally.

2.	On the management server, open the Windows Control Panel and select Programs > Uninstall a program.

3.	Select Forcepoint DLP, then click Uninstall/Change.

4.	When asked if you want to add, remove, or modify Forcepoint DLP, select Modify.

5.	Click Next until you get to the Restore Data from Backup screen.

 

Note  Backups must be enabled in order to restore a backup from another DLP management server. See the DLP installation guide for instructions.

6.	Select the Load Data From Backup check box and click the Browse button to locate the backup file.

7.

Select the Clear Forensics since last backup check box if you want to use only the stored forensics from your backup file; this will remove all forensics gained since the last backup. (Leaving it unchecked means that your forensics data after the restore will include the backed-up forensics and the forensics added since that backup.)

8.	Click Next until you begin the restore procedure.

During the restore process, a command-line window appears; it may remain for some time, but it disappears when the recovery is complete.

The restore operation completely erases all policies and data (and, if checked, forensics) of the current system, and replaces them with the backed-up data.

9.	Complete the restore wizard.

10.	To review the restore activity, read the DataRestore.log file located in the backup folder (for example, MM-DD-YYYY-HH-MM-SS).

11.	Log onto the Data Security module of the Forcepoint Security Manager.

12.	To enable your crawlers to work with the newest encryption keys, open each discovery, fingerprint, and machine learning task in your system and edit it in some way, even just the description.

If you have Box discovery tasks, edit them and enter your Box credentials again.

If your fingerprint tasks were configured to be exported to a machine with credentials, edit them and reenter the machine credentials.

13.	Select Deploy.

 

Note  If the backup system contains many policies, it may take a while to load the policies and deploy them.

• Related Articles

• F1E DLP Inline Proxy

  Introduction to the F1E Inline Proxy The Forcepoint DLP Inline Proxy, which runs locally on the F1E Endpoint Client machine, is the preferred way to enforce web policies and is intended to replace the use of F1E browser extensions. As described in ...

• (-3) General (unknown) error" Encountered During Forcepoint DLP Secondary Server Registration

  Summary Restart the Websense Data Security Fingerprinting Database to resolve the issue. Problem When attempting to complete a Modify of the Forcepoint DLP installer on a Secondary Windows Server to register the machine to a DLP Management Server, an ...

• DLP module User Interface Error

  Observation During the session, it was observed that the Forcepoint DLP module encountered a UI error (Forcepoint DLP could not be launched). This issue was caused by corrupted files in the following directories: - `%DSS_HOME%tomcat\wbsnData\` - ...

• Linux F1E DLP Endpoint Support

  Summary Support for the Linux environment has ceased for the time being. Problem The Linux Endpoint appears to be missing from modern F1E releases and is not present within the F1E and Forcepoint DLP Endpoint Operating System and Browser Support ...

• DLP System Log: The forensics repository (or incident archive) reached xxx% from its maximum capacity

  Summary Details troubleshooting steps to take when the Forensics Repository or Archival folder approaches or surpasses its configured limit. Problem The Forcepoint DLP System Log reports warnings such as the following: The Incident Archive has ...