How to configure the Csv Lookup Plugin

Products

• Data Loss Prevention Enforce

Issue/Introduction

Provides information on how to configure an attribute lookup using a .csv file.

Resolution

Relevant versions:  8.0 - 11.5

This document will show you how to configure an attribute lookup using a .csv file.

1.  Edit the plugin.properties file to:

• Specify the plugins to be loaded
• Specify the order in which they should be executed
• Specify the parameters to be passed on to the plug-ins
• Point to other configuration files

 

2.  Make sure all the jar files on which the plugins depend are in the plugins folder (Vontu/Protect/plugins or C:\Vontu\Protect\plugins)

3. Enable the following parameters (i.e. make sure they are not commented out):

com.vontu.api.incident.attributes.AttributeLookup.plugins=Vontu Csv Lookup
        (this is the type of lookup to be performed)

com.vontu.api.incident.attributes.AttributeLookup.parameters=sender
         (this is the unique key used in the input file)

com.vontu.plugins.execution.chain=com.vontu.lookup.csv.CsvLookup

com.vontu.lookup.csv.CsvLookup.properties=CsvLookup.properties
         (the physical name of the file with the lookup specification)

4.  Modify CsvLookup.properties

     Add or modify the following parameters:

csv_file_path: should contain an absolute or relative path to the data file
        (e.g.  C:\\Vontu\Protect\datafiles\attributes.csv)

delimiter: Vontu 6.0 supports comma, tab, and pipe delimited files (e.g., delimiter=,)

attributes: should contain one entry for each of the custom attributes defined
         » The format for each entry is: attr.Name=Name (e.g. attr.sender-email=Email
         » The parameter name (e.g., sender-email) is case-sensitive

keys: should be the attribute(s) to be used as a unique key
        (e.g. keys=Email)

5.  Create a test incident in the system to verify the lookup works.

NOTE:  Once you have made edits to the configuration file, go to the Services panel and stop and restart the Vontu Manager service

-----------------------------------------------------------------------------------------------------------

The following examples will give you an idea of what your properties files and .csv file should look like:

C:\Vontu\Protect\config\CsvLookup.properties:

attr.sender-email = email
attr.First\ Name = FIRST_NAME
attr.Last\ Name = LAST_NAME
attr.Manager\ Email = Mgr_email
attr.Phone\ Number = phone
attr.Manager\ Last\ Name = Mgr_lastname
attr.Manager\ First\ Name = Mgr_firstname
attr.Business\ Unit = org
attr.endpoint-user-name = Username
attr.file-owner = fileowner

keys = email:Username:file-owner

The key point here is that each product is using a different key.  Inline SMTP uses email, Endpoint uses Username, and Discover uses file-owner.

C:\Vontu\Protect\config\Plugins.properties

com.vontu.api.incident.attributes.AttributeLookup.plugins=Vontu Csv Lookup

com.vontu.api.incident.attributes.AttributeLookup.parameters=sender,message

com.vontu.plugins.execution.chain=com.vontu.lookup.csv.CsvLookup

com.vontu.lookup.csv.CsvLookup.properties=CsvLookup.properties

Nothing much here to note, except that we are sending the sender and message parameter groups to the lookup plugin.

You may need to add another group.

C:\Vontu\Protect\plugins\senders.csv

FIRST_NAME|LAST_NAME|email|Mgr_email|phone|Mgr_lastname|Mgr_firstname|org|Username|fileowner
Joe|User|[email protected]|[email protected]|634421|4154557662|Manager|Jane|Accounting|ENDPOINT\Joe|ENDPOINT\Joe

This is the entire contents of the file.  The first line is the header, and we have only 1 lookup user, Joe User.  You can cut and paste the 2nd line to modify for multiple lookups.

Applies To

The details in this technote apply to DLP versions earlier than 11.6.

In DLP 11.6, configuration of Lookup Plugins was moved to the UI.