Multiple URLs present in mac browser incidents

Products

• Data Loss Prevention Core Package
• Data Loss Prevention
• Data Loss Prevention Endpoint Suite
• Data Loss Prevention Endpoint Prevent

Issue/Introduction

Sometimes, when user switches tabs on the endpoint from one tab window to another tab window, the endpoint incident displays the wrong URL (not the URL of the tab in which incident was generated).

This happens on Macs with any browser.

Steps to duplicate this issue.

1. In the agent config, provide a domain filter to ignore "example1.com".
2. The policy should ignore a sensitive file upload in the example1.
3. Create a sensitive file and upload it on example1.
4. The file was successfully uploaded, which is expected behavior, the ignore filter worked as expected.
5. Now open a new tab, leave the example1 tab open, and login to the "example2.com".
6. Try to upload the same file in example2, it fails to upload, as expected.
7. Again try to upload the same file in the example1 which is opened in the original tab.
8. This time the file is blocked and failed to upload. 
9. Per the ignore domain filter, the expected behavior is to allow the upload to example1 without an issue.

This creates a false positive incident.
The URL for the false incident is incorrect, it shows the URL of example2.com instead of example1.com.

Cause

On Macs, the domain filter is not working properly in case of tab switching.

Resolution

A fix is to be included in DLP 16.1.