Browser paste incidents are not showing a URL destination in the console

Products

• Data Loss Prevention

Issue/Introduction

Browser paste incidents are not showing a URL destination in the console.

There is no destination field in the incident.

Environment

DLP 15.x / 16.x

Cause

This is caused by the incident being detected as a clipboard event rather than a http/https event.

This happens when the global application monitoring (GAM) settings are configured to monitor the clipboard channel. By default, when http / https for Edge or Chrome is configured, the clipboard channel will be monitored. If the GAM for Edge or Chrome is configured to monitor clipboard then it overwrites this behavior and causes the http / https paste events to be detected as clipboard events. Http / Https incidents have information about a destination URL whereas a clipboard event will not.

This can be confirmed by viewing the incident and checking the channel to see if it is defined as a Clipboard incident or Http / Https incident.

Resolution

Modify the Global Application monitoring settings and remove the clipboard option from Chrome and Edge. This will allow the innate behavior DLP to detect paste events in to the browsers as http / https events.