Copy to Network Share generates Incidents even when Copy fails due to insufficient permissions

Products

• Data Loss Prevention Endpoint Prevent

Issue/Introduction

You are receiving incidents in the Enforce console from the 'Copy to Network Share' channel. However on remediating the incident you notice that the file in question was never successfully copied to the network share.

Environment

Release : 15.x

Component : Copy to Network Share

Cause

This is as designed behavior

Resolution

On Windows machines running DLP Endpoint agents, the attempt to copy to a share will create an incident, even if the copy ultimately fails due to other reasons such as insufficient permissions.

On Mac OS machines running DLP endpoint, the incident is generated after the successful copy.