Video Screencast Help
Symantec to Separate Into Two Focused, Industry-Leading Technology Companies. Learn more.

Monitoring folder shares

Created: 04 Apr 2013 | 11 comments

Can I use DLP to only allow copying of files from one share to another share but log an incident if it is copied anywhere else?

Operating Systems:

Comments 11 CommentsJump to latest comment

W007's picture

Hello,

Look this one of discussion

https://www-secure.symantec.com/connect/forums/how-configure-dlp-protect-specific-network-share-fileserver

Don't forget to mark your thread as 'SOLVED' with the answer that best helped you.

pete_4u2002's picture

Do you mean exceptions for few servers and detect and prevent on others?

John Smithers's picture

I have files indexed here \\server1\share1 that I want to protect. I don't care about raising an incident if people copy files from \\server1\share1 to \\server2\share2 but I do care if the files are copied locally or to anywhere else (like \\server2\share3).

kishorilal1986's picture

Hi Kohn,

U can do this by adding exception to the fileshare which u wanted to allow.

so other than thse added exception fileshare your DLP will genearte incidents.

https://www-secure.symantec.com/connect/forums/end...

https://www-secure.symantec.com/connect/forums/how...

kishorilal1986's picture

Hi Joh,

Just ligin to Enforce and go the tab System anf follow below and refer below important thread

  1. system -> agent configuration -> edit the configuration
  2. Edit the monitoring filter by adding the path to the fileshare.

https://www-secure.symantec.com/connect/forums/dlp...

http://www.symantec.com/connect/forums/internal-ip...

https://www-secure.symantec.com/connect/forums/cre...

John Smithers's picture

Hi K S Sharma,

as far as I can see you can only add IP addresses in the monitoring fields, not UNC paths to file shares.

pete_4u2002's picture

yes, that is applicable for HTTP/FTP not for UNC

John Smithers's picture

Seems like we're going round in circles frown

So it can't be done with DLP?

kishorilal1986's picture

Yes Pete, I am reffreing for IP filtering.(Exception)

I have given the best solution as per the query asked by John. If he wanted to do the same for UNC then also refer below for more

https://www-secure.symantec.com/connect/forums/how...

https://www-secure.symantec.com/connect/forums/sym...

https://www-secure.symantec.com/connect/forums/how...

https://www-secure.symantec.com/connect/forums/dlp...