Enabling advanced functions for DLP scripting language

Products

• Data Loss Prevention
• Data Loss Prevention Enforce
• Data Loss Prevention Cloud Package
• Data Loss Prevention Cloud Detection Service for REST
• Data Loss Prevention Cloud Detection Service for ICAP
• Data Loss Prevention Cloud Detection Service
• Data Loss Prevention Cloud Service for Email
• Data Loss Prevention Enterprise Suite
• Data Loss Prevention Core Package

Issue/Introduction

As per Symantec™ Data Loss Prevention Detection Customization Guide, enabling advanced function requires setting the system property "genieScript.ADVANCED_FUNCTION_ENABLED.str" to true.

Without it, you will be not able to use Execute, Print and ReadFile functions in your custom scripts.

Environment

Release : All supported versions of DLP (15.x-16.x)

Resolution

The system property has to be enabled on Enforce and all Detection servers.

On the Enforce Server:

1. Go to X:\Program Files\Symantec\DataLossPrevention\EnforceServer\Services (Windows) or /opt/Symantec/DataLossPrevention/EnforceServer/Services (Linux)

2. Open SymantecDLPManager.conf and add the line below under additional 202 settings:

wrapper.java.additional.203 = -DgenieScript.ADVANCED_FUNCTION_ENABLED.str=true

3. Save the file and restart the DLP Enforce services.

 

On each of the Detection Servers:

1. Go to the Enforce console, click on the Detection Server and go to Server Settings.

2. Add below:

-DgenieScript.ADVANCED_FUNCTION_ENABLED.str=true

at the end of the already existing BoxMonitor.FileReaderMemory settings, e.g.:

-Xrs -Xms1200M -Xmx4G -DgenieScript.ADVANCED_FUNCTION_ENABLED.str=true

3. Save the settings and recycle the DLP service on the Detection Server.

Additional Information

NOTE: This Advanced Scripting option is NOT compatible with the DLP Cloud Service.

DLP policy conditions that contain advanced scripts will be ignored and be evaluated to FALSE on the DLP Cloud Service.