Copy to Network Share generates Incidents even when Copy fails due to insufficient permissions

book

Article ID: 210644

calendar_today

Updated On:

Products

Data Loss Prevention Endpoint Prevent

Issue/Introduction

You are receiving incidents in the Enforce console from the 'Copy to Network Share' channel. However on remediating the incident you notice that the file in question was never successfully copied to the network share.

Cause

This is as designed behavior

Environment

Release : 15.x

Component : Copy to Network Share

Resolution

On Windows machines running DLP Endpoint agents, the attempt to copy to a share will create an incident, even if the copy ultimately fails due to other reasons such as insufficient permissions.

On Mac OS machines running DLP endpoint, the incident is generated after the successful copy.