DLP Print Monitor - How it works
Just wonder does anyone know in details how DLP Print monitor works in Symantec DLP
I am actually trying to understand how print monitor works. Does it just monitor print jobs sent to windows print spooler service (spoolsv.exe) or it actually uses some other techniques. one of the info i got from forum is DLP endpoint agent monitors windows GDI calls as shown by below post. other writeup i read suggest that DLP endpoint also monitor print drivers. anyone know that is done?
I have a customer who implemented a network printing for their mainframe. Mainframe sends print jobs to a windows server (BAR server) via IBM RJE/SNA emulation, the windows server will then in turn send the print jobs to another print server (solaris) via LPD/LPR. The printer is actually connected to the solaris print server. According to customer, the BAR server is not using the windows spooler service to send the job to the solaris print server. if this is the case, can our DLP endpoint still monitor the print jobs? Or under what conditions can only DLP endpoint inspect the print jobs for DLP?
how about setting up application monitoring to monitor the application for any print/fax requests, will that solve the requirement.
Thanks in advance for looking at my post