Users getting a quarantine message on endpoint block but no quarantine is enabled in the response rules

Products

• Data Loss Prevention Enterprise Suite

Issue/Introduction

You are receiving a popup as below, and don't understand why you are receiving a Quarantine Message as you do not have it enabled. And want to prevent it from occurring.

 

 

Environment

Release : 15.8

Component : Endpoint Prevent

Cause

The difference in the messaging you are experiencing is the difference between copying a file to a USB drive or trying to save a new file to the USB drive.

Copy an existing file and you get:

However, if you open a program, create something and try to save it to the USB drive you get.

You also get the same behavior if you use the save as dialog and select the USB drive.

Resolution

Working as designed

This is expected behavior because if a file is being created, and we block it then the file would be gone with no way to recover it. 

Therefore when the save as dialog is used and we block the operation we quarantine the file so that it can be recovered.

Additional Information

You can customize the quarantine message in the agent configuration > Advanced Settings by changing the value of UI.QUARANTINE_PROMPT.str 

You can customize the quarantine location in the agent configuration > Settings by changing the default path located under File Recovery Area Location.

The same behavior will be observed when creating a file on a network share and it is blocked.

More detail can be found in

How Does the DLP Endpoint Agent Block Data in Motion Requests(USB and Network monitor)