WindSurf gatelet activity

Products

• CASB Advanced Threat Protection
• CASB Audit
• CASB Gateway
• CASB Gateway Advanced
• CASB Security Advanced
• CASB Security Advanced IAAS
• CASB Security Premium
• CASB Security Premium IAAS
• CASB Security Standard
• CASB Securlet IAAS
• CASB Securlet SAAS
• CASB Securlet SAAS With DLP-CDS

Issue/Introduction

WindSurf activity in both CASB activity and DLP incident may report different sizes or names than expected.

Resolution

WindSurf gatelet works as expected.

Windsurf IDE applies unique logic to decide how the file is read and transferred to the server. 

• For smaller files, generally the whole file is transferred.
• For larger files, only certain lines (batches of ~100 lines from various sections of the file) are read and transferred.
• File contents can be chunked within a single or multiple HTTP requests.

What this means:

• Gateway may not always receive or report the complete file as a whole.
• The parts/contents of the file that are received will be sent to DLP for scanning.
• This means that the file size seen in DLP incident (in case of a violation) may not always match the actual file size.
• It is also observed that Windsurf IDE may upload the same file contents multiple times; thus there will be multiple investigate logs and possibly more than one incident.