How to setup Application Monitor to monitor file access via Bluetooth devices.
Data Loss Prevention (DLP) Endpoint Prevent
Gathering device information :
Name (Required) = Bluetooth
Binary Name = fsquirt\.exe
Internal Name = fsquirt\.exe
Original Filename = fsquirt\.exe
Send to Clipboard
Under "Enable monitoring of local drive, removable media and other filesystem activities" check
Monitor Application File Access to File Read.
Now you are ready to test the Bluetooth file transfer.
Note 1: On MAC OSX system the process name to monitor bluetooth is called "blued" - see https://en.wikipedia.org/wiki/Blued_(macOS). As of 15.8 this is NOT added by default and will need to be added manually. See documentation under "Adding a macOS application" and ensure that monitoring AFA is selected for this application.
Note 2: In DLP version 15.1 and above the fsquirt.exe application is enabled for Application Monitoring by default with the application name of "Microsoft Windows Bluetooth" in the Application list. But additional programs may need to be added in order to expand the monitoring capability of DLP Endpoint Prevent.
Article ID 163800: How to enable monitoring for USB Bluetooth adapters