Error starting a virtual machine on Oracle VirtualBox when DLP Endpoint Agent is installed on same machine

Products

• Data Loss Prevention Endpoint Prevent

Issue/Introduction

We receive errors while starting virtual machine on Oracle VirtualBox when DLP Endpoint Agent is installed on a same machine.

Environment

Windows 10, Oracle VirtualBox 5.1.28 r 117968 (Qt5.6.2), DLP Endpoint Agent 14.6 and 15.0.

Cause

The DLP Endpoint Agent is hooking into processes of Oracle Virtual Box (VirtualBox.exe and VboxSVC.exe) as well as into the virtual disk (*.vdi).

Resolution

We can whitelist processes and virtual disk of Oracle VirtualBox under Agent Configuration and Application Monitoring to resolve this issue:

1. Log into Enforce console > System Agents > Agent Configuration > Agent Monitoring > Filter by File Properties
2. Add *.vdi in the ignore filter as shown below:




3. Click Save > Apply Configuration > select the group and click Update Configuration

4. Go to System > Agents > Application Monitoring and whitelist VirtualBox.exe as shown below:



5. Click Save to save changes
6. Repeat the same process for VBoxSVC.exe:



7. Click Save to save changes