File Copy to Network Share received block pop-up with Prevent: Encrypt response rule
Article ID: 171317
Updated On:
Products
Data Loss Prevention Endpoint Prevent
Cause
'Prevent: Encrypt' response rule supports Removable Media (USB) destinations for the ICE integration in DLP 15MP1.
Other channels, such as 'Copy to Network Share' and HTTPS (Chrome), will result in a block action to prevent the data from leaving the endpoint.
Other channels, such as 'Copy to Network Share' and HTTPS (Chrome), will result in a block action to prevent the data from leaving the endpoint.
Resolution
In order to utilize the ICE integration response rule, Prevent: Encrypt, without impacting normal business operations, a response rule conditon is required.
The response rule condition 'Protocol or Endpoint Monitoring' should be used in this case to allow the Prevent: Encrypt response rule to trigger when Removable Media channel is detected.
All other channels will not be affected by this response rule.
The response rule condition 'Protocol or Endpoint Monitoring' should be used in this case to allow the Prevent: Encrypt response rule to trigger when Removable Media channel is detected.
All other channels will not be affected by this response rule.
Feedback
Yes
No
Powered by
