DLP endpoint agent incident creates an Unknown URL due to drag and drop of local file in Chrome

Products

• Data Loss Prevention Enterprise Suite
• Data Loss Prevention Endpoint Prevent
• Data Loss Prevention Endpoint Suite
• Data Loss Prevention

Issue/Introduction

Drag and drop file operation into Google Chrome results in an incident with an “Unknown URL”.

Environment

Release: 15.7 and later

Component: Endpoint Prevent

Cause

There is no URL to capture when opening a local file.

Resolution

The only current workaround is to inform the users to use the File Open menu operation rather than Drag and Drop so the agent will recognize this action as a file being opened locally and not an attempted upload.

 

 

Additional Information

Feature request # ISFR-2096 has been created requesting it to capture the local file path so remediators will know it was a locally opened file and not an exfiltration event.