File Copy to Network Share received block pop-up with Prevent: Encrypt response rule
book
Article ID: 171317
calendar_today
Updated On:
Products
Data Loss Prevention Endpoint Prevent
Cause
'Prevent: Encrypt' response rule supports Removable Media (USB) destinations for the ICE integration in DLP 15MP1.
Other channels, such as 'Copy to Network Share' and HTTPS (Chrome), will result in a block action to prevent the data from leaving the endpoint.
Resolution
In order to utilize the ICE integration response rule, Prevent: Encrypt, without impacting normal business operations, a response rule conditon is required.
The response rule condition 'Protocol or Endpoint Monitoring' should be used in this case to allow the Prevent: Encrypt response rule to trigger when Removable Media channel is detected.
All other channels will not be affected by this response rule.