Error starting a virtual machine on Oracle VirtualBox when DLP Endpoint Agent is installed on same machine

Products

• Data Loss Prevention Endpoint Prevent

Issue/Introduction

We receive errors while starting virtual machine on Oracle VirtualBox when DLP Endpoint Agent is installed on a same machine.

Cause

The DLP Endpoint Agent is hooking into processes of Oracle Virtual Box (VirtualBox.exe and VboxSVC.exe) as well as into the virtual disk (*.vdi).

Environment

Windows 10, Oracle VirtualBox 5.1.28 r 117968 (Qt5.6.2), DLP Endpoint Agent 14.6 and 15.0.

Resolution

We can whitelist processes and virtual disk of Oracle VirtualBox under Agent Configuration and Application Monitoring to resolve this issue:

1. Log into Enforce console > System Agents > Agent Configuration > Agent Monitoring > Filter by File Properties
2. Add *.vdi in the ignore filter as shown below:




3. Click Save > Apply Configuration > select the group and click Update Configuration

4. Go to System > Agents > Application Monitoring and whitelist VirtualBox.exe as shown below:



5. Click Save to save changes
6. Repeat the same process for VBoxSVC.exe:



7. Click Save to save changes