Unknown Source Application Clipboard monitor to Webex

Products

• Data Loss Prevention Endpoint Prevent
• Data Loss Prevention

Issue/Introduction

Sometimes the source application name on incidents shows as unknown.

Environment

 

Symantec Data Loss Prevention (DLP) Endpoint Prevent

Resolution

Clipboard monitoring:

• The Clipboard hook will be loaded in all processes running on the system except for white-listed processes in the Global Application Monitoring list.
• Clipboard Paste incidents show the source application as "unknown" if the user copied data from a whitelisted application because DLP cannot identify the source of the clipboard data. 
• Similar behavior is expected in the event that data is copied before the DLP agent started and then pasted after the DLP agent is started.
• Clipboard Copy incidents will not have any source application details.