How to enable monitoring for USB Bluetooth adapters

Products

• Data Loss Prevention Cloud Prevent for Microsoft Office 365
• Data Loss Prevention Endpoint Prevent
• Data Loss Prevention Network Monitor
• Data Loss Prevention Network Prevent for Email
• Data Loss Prevention for Mobile
• Data Loss Prevention Enforce
• Data Loss Prevention Network Discover
• Data Loss Prevention Network Protect
• Data Loss Prevention Endpoint Discover
• Data Loss Prevention Cloud Service for Email
• Data Loss Prevention Cloud Detection Service
• Data Loss Prevention API Detection for Developer Apps Virtual Appliance
• Data Loss Prevention Network Prevent for Web Virtual Appliance
• Data Loss Prevention Network Prevent for Email Virtual Appliance
• DLP-S500
• Data Insight for DLP
• Data Loss Prevention Cloud Package

Issue/Introduction

As a DLP Admin, I need to monitor file transfers via Microsoft Windows Bluetooth and 3rd party Bluetooth adapters connected via USB.

No incidents triggered when a file is transferred via 3rd party Bluetooth adapters to Bluetooth-enabled devices.

Environment

Microsoft Windows Endpoint.
3rd Party Bluetooth adapter (USB).

Cause

3rd party Bluetooth adapters may use different processes to access and transfer files.

Resolution

Identifying the process access the files to be sent over Bluetooth is key to the solution. Microsoft sysinternals tool, Process Monitor, is key to identifying all processes and child processes used to access files for transfer.

By default, fsquirt.exe is enabled for Application Monitoring, but additional programs may need to be added in order to expand the monitoring capability of DLP Endpoint Prevent.

Enforce Control Panel> System>Agents> Application Monitoring> Add application

Example 1: BTWUIExt.exe



 

Additional Information

Reference:

Article ID 162661: DLP How to setup Bluetooth device monitoring