DLP Endpoint agent is unable to detect file uploads on virustotal.com website in Chrome browser.

Products

• Data Loss Prevention Endpoint Prevent

Issue/Introduction

If you upload a sensitive file to virustotal.com website in the Chrome browser, the file is successfully uploaded without triggering an endpoint HTTPS incident. If the same file is uploaded to any other website like dlptest.com in the Chrome browser, the file is detected by the DLP agent, and an incident is triggered.

Environment

DLP 15.8.x and 16.0

Cause

virustotal.com is a non-standard website that does not follow the expected behavior for posting data that the DLP agent relies on.

Resolution

Starting with DLP 16.0 RU1 (16.0.1), Google and Broadcom collaborated on an SDK where DLP can query the Chrome SDK for the data being uploaded to a specific site so that DLP can do the detection. This increased capability allows detection of websites that do not follow the expected behavior for posting data that DLP relies on without having this new SDK to get the data from. Customers that require detection of these non-standard websites like virustotal.com need to upgrade to 16.0 RU1 switching to the new Chrome Content Analysis SDK.