Attachments not getting captured in incident details for files uploaded to fangcloud.com website

Products

• Data Loss Prevention Cloud Detection Service for ICAP

Issue/Introduction

Uploading of confidential data to fangcloud.com gets blocked but the incident doesn't show the attachment attribute and attachment file

Environment

DLP 15.8 and later
On-premise Network Prevent for Web and CDS for Web

Cause

Uploads to fancloud.com are nonmultipart attachments. The NonMultipartAttachment.config needs to be configured to monitor and get the filename.

Resolution

This issue should be resolved in DLP Cloud around the time DLP 16.0 RU2 is released which is expected to be in May 2024.
All of DLP cloud gets updated to the same version that is always backwards compatible with older Enforce versions. In order for CDS to remain compatible with 16.0 RU2 Enforce when it releases, CDS will be updated to its 16.0 RU2 either on or just before the RU2 Enforce releases.

Workaround for On-premise Network Prevent for Web:

1. Add the following entry  to NonMultipartAttachment.config in [install dir]/Symantec/DataLossPrevention/DetectionServer/16.0.00000/Protect/config

#fangcloud.com

 Host == fangcloud.com :: HEADERFIELD:x-file-name

2. Restart Detection server service.