Data Loss Prevention

 View Only
  • 1.  How to exclude print events based on File name filter in DLP

    Posted Nov 03, 2015 05:44 AM

    Hello

    Please help me out on below isse,

     

    Is it possible to exclude print operation based on File name filter ?



  • 2.  RE: How to exclude print events based on File name filter in DLP
    Best Answer

    Posted Nov 03, 2015 10:39 AM

    Hi heathu,

     

    You can exclude it using combined exception.

    On Detection Exceptions, Add Exception -> Protocol "Protocol or Endpoint Monitoring" -> give it a name and tick Printer/Fax on Endpoint Destination.

    Then select Also Match: Message Attachment or File Name Match -> click Add.

    Insert File name(s) you want (Ex: Test.txt) and click Ok.

    Then save policy.

     

    Regards.

     



  • 3.  RE: How to exclude print events based on File name filter in DLP

    Posted Nov 04, 2015 06:22 AM

    Hi Paulo

     

    i have tried the same but issue still exists

    i want to exclude outlook memo style files, when user take print the incident triggering with the file name "Microsoft Office Outlook - Memo Style"

    i was tried in the exception given Endpoint protocol and file name identifier "Microsoft Office Outlook - Memo Style"

     

     

    Still am getting the incidents mainly these files dont have any extentions



  • 4.  RE: How to exclude print events based on File name filter in DLP

    Posted Nov 04, 2015 07:00 AM

    Hi heathu,

    I tried this combination and it worked, but needs more tests in terms of what you want to do.

    On Detection Exceptions, Add Exception -> Protocol "Protocol or Endpoint Monitoring" -> give it a name and tick Printer/Fax on Endpoint Destination.

    Then select Also Match: Message Attachment or File Type Match -> click Add.

    On Encapsulation Formats tick Microsoft Outlook Express (EML) and Microsoft Outlook (MSG, PST).

    As i said, it needs more tests in terms of complience with your type and levels of protection, but in a simple test, it worked.

     

    Regards