Understanding Agent Channels and Application Monitoring

search cancel

book

calendar_today

Data Loss Prevention Endpoint Prevent

You want to understand the basics of Agent Channel monitoring, Application Monitoring Rules, and their interaction.

DLP 15.x

This is where you enable the channels you want to monitor for Agent Groups which have been assigned this configuration (Understanding how DLP Agents receive Configurations and Policies).
- Generally, a channel must be enabled here and within an Application Monitoring Rule, with some exceptions as discussed below.

Here you can configure monitoring filters for the channels you have enabled.
- You can add a filter with the Action of either Ignore or Monitor
- You can configure the monitoring filter to match certain channel attributes, such as:
  - File type/size for Filter by File Properties Rules
  - Domain/IP, etc for Filter by Network Properties Rules

In general, the channels enabled in the Agent Configuration are monitored for applications that do not have an Application Monitoring rule defined, with the following exceptions:
- Application File Access - Open/Read.
  - This must be enabled both at the Agent Channel level, and at the Application Monitoring level.
- Clipboard Paste monitoring is not enabled for undefined applications.
  - This must be enabled both at the Agent Channel level, and at the Application Monitoring level.
When HTTPS monitoring is enabled for Chrome or Edge, Application File Access - Read and Clipboard - Paste are automatically enabled. It is recommended to leave these off in their respective Application Monitoring rules to prevent duplicate incidents.

This is where you globally disable channels for specific applications, which have been enabled in any Agent Configuration.

This is where you disable channels for specific applications, which have been enabled in this Agent Configuration. Rules defined here take precedence over Global Application Monitoring rules defined for the same application.

thumb_up Yes

thumb_down No