Video Screencast Help
Symantec to Separate Into Two Focused, Industry-Leading Technology Companies. Learn more.

Symantec DLP Edpoint Prevent no detecta incidentes al enviar archivos .zip o .rar en Hotmail

Created: 19 Jul 2012 | 1 comment
kdashtobi's picture

Hola a todos.

Tengo instalado varios agentes de Symantec DLP 11.5.1 que reportan al modulo de Endpoint Prevent, tambien se configuro una politica de prueba.

El problema es que al enviar un archivo .zip o .rar que contenga otro archivo con información confidencial como esta configurado en la politica, no se detecta ningun incidente, pero esto solo ocurre cuando el archivo es enviado desde Hotmail, de algún otro correo WEB si es detectado.

¿Endpoint Prevent no es compatible con Hotmail o acaso Hotmail actualizo su pagina ultimamente?

La configuración de los agentes es la siguiente:

Name Description

Enable Monitoring
Select the channels to monitor
Destinations
 Removable Storage
 CD/DVD
 Local drive
 Printer/Fax
 Clipboard
Email
 Outlook
 Lotus Notes
Web
 IE(HTTPS)
 Firefox(HTTPS)
 HTTP
 FTP
Instant Messaging
 AIM
 MSN
 Yahoo Messenger
Applications
 Application File Access
Network Shares
 Copy to local drive
 Copy to share
Filter by File Properties
Add filters here to optimize monitoring. Filters tell the agent to monitor or ignore files based on protocol, destination, file size, file type, or file path.
Filters run in the order they appear. A file is ignored or monitored based on the action of the first filter that it matches.
You can change the order that filters run by changing the numbers in the Order column.
 
Add Monitoring Filter
Order Actions Destination File Attributes  
  Monitor Application File Access, CD/DVD, Email Attachment, FTP transfer, HTTP/HTTPS Attachment, IM File transfer, Removable Storage
size > 1   KB
type = *.doc , *.docx , *.jar , *.mpp , *.pdf , *.ppt , *.pptx , *.rar , *.txt , *.wcm , *.xls , *.xlsx , *.zip
 
  Monitor CD/DVD, Email Attachment, FTP transfer, HTTP/HTTPS Attachment, IM File transfer, Removable Storage
size > 1   KB
type = .zip, .rar, .doc, .xls
 
  Ignore Local Drive, Removable Storage
type = *.v2i , *.vmdk , *.vmem
 
  Ignore Application File Access, CD/DVD, Local Drive
type = *
 
 
Specify Default File Filter Action
The following action will be applied to any file that does not match any of the file filters configured above:
 Monitor
 Ignore
Filter by Network Properties
Specify Network filters here to optimize monitoring. These filters will tell the Agent to monitor or ignore network traffic based on IP addresses or domain names.
 
IP Filters:
IP
 
Domain Filters:
HTTP
HTTPS
Discussion Filed Under:

Comments 1 CommentJump to latest comment

kdashtobi's picture

Como dato adicional al enviar un correo adjuntando un archivo en su formato original (.txt, .xls, .doc) desde la pagina de Hotmail este si es detectado como incidente pero al enviar el mismo archivo en un formato rar no en detectado como incidente