DLP Endpoint agent is unable to detect file uploads on virustotal.com website in Chromium browsers.
Article ID: 276562
Updated On:
Products
Issue/Introduction
If you upload a sensitive file to virustotal.com website in Chromium browsers, the file is successfully uploaded without triggering an endpoint HTTPS incident. If the same file is uploaded to any other website like dlptest.com in Chromium browsers, the file is detected by the DLP agent, and an incident is triggered.
Cause
virustotal.com is a non-standard website that does not follow the expected behavior for posting data that the DLP agent relies on.
Resolution
Starting with DLP 16.0 RU1 (16.0.1), Google Chrome Content Analysis Connector was introduced.
Starting with DLP 25.1, Edge and Firefox Content Analysis Connectors were introduced.
This increased capability allows detection of websites that do not follow the expected behavior for posting data that DLP relies on. Customers that require detection of these non-standard websites like virustotal.com should upgrade to the latest DLP release to allow for monitoring browsers using content analysis connectors on Windows endpoints
Additional Information
Feedback
