Paths to be used for network shares under file attributes in the DLP agent configuration

Products

• Data Loss Prevention Endpoint Prevent
• Data Loss Prevention Enforce
• Data Loss Prevention

Issue/Introduction

What paths need to be mentioned in the path under "File Attributes" on the "Channel Filters" tab when we select "Copy to local drive" or "Copy to share" under "Network Shares" in the Agent configuration?

Resolution

1. “Copy to Local Drive” monitors/ignores files copied from network shares to the Windows endpoint. Hence the path to monitor or ignore becomes the network share from where the files will be copied to the Windows Endpoints (Local Drive). Here the source is what we ignore or monitor.
2. “Copy to Share” monitors/ignores files copied from Windows and Mac endpoints to network shares. Here the network share path is what we are supposed to ignore or monitor, hence we track the destination here.

We monitor or ignore Network server shares in both cases.

Please refer to the DLP online help pages for the valid network paths.
See the "File Attributes" section of the Configuring file filters page.

When you set a wildcard domain filter in "File Path" it should also cover access via hostname.
The agent is attempting to resolve the FQDN and match it with filter.

Example:

Filter settings:


What you will see in the Agent log:



* - filter with order #0 is #1 in GUI.

Additional Information

1. To configure path filter containing server IP address, use below syntax in the path:
\\<IP address>\*\*

2. You can also specify specific folder name after IP, ex:
\\<IP address>\test\*

Note: You cannot specify only IP address alone, it won't allow you to save.