File Copy to Network Share received block pop-up with Prevent: Encrypt response rule

book

Article ID: 171317

calendar_today

Updated On:

Products

Data Loss Prevention Endpoint Prevent

Cause

'Prevent: Encrypt' response rule supports Removable Media (USB) destinations for the ICE integration in DLP 15MP1.
Other channels, such as 'Copy to Network Share' and HTTPS (Chrome), will result in a block action to prevent the data from leaving the endpoint.

Resolution

In order to utilize the ICE integration response rule, Prevent: Encrypt, without impacting normal business operations, a response rule conditon is required.
The response rule condition 'Protocol or Endpoint Monitoring' should be used in this case to allow the Prevent: Encrypt response rule to trigger when Removable Media channel is detected.
All other channels will not be affected by this response rule.