Data Loss Prevention Endpoint Agent not detecting file transfers in Finder to iPhone or other iOS device

Products

• Data Loss Prevention Endpoint Prevent

Issue/Introduction

You are trying to prevent sensitive data from being transferred to iPhones or other iOS devices on MacOS

Cause

In Newer version of MacOS, the AMPDevicesAgent service is used for file transfers between MacOS and iOS devices.

Resolution

To resolve, and allow proper detection of file transfers to an iPhone or other iOS devices on a MacOS You will need to Add AMPDevicesAgent to the Global Application Monitoring list for Mac.

Go to the Global Application Monitoring list in the Enforce Console and add a new Application for Mac.

The Binary name should be listed as AMPDevicesAgent

Make sure to select all channels needed.

After doing so, you can go to the Agent Configuration that those MacOS Endpoint Agent's are assigned and select Application Monitoring.

You will want to Add a new Application, select the newly created AMPDevicesAgent from the list and save.

After doing so, update the policy on the MacOS device, and detection should now function properly for data being copied to an iPhone or iOS device.