Data Loss Prevention

Hello,

we decided to deploy Endpoint servers for our clients and we just did the installation.

I installed the product on a dedicated folder on my D:, however I can see a lot of "drop..." folder + icap.. + Packet_spool on the root of my D:

=> Is it normal ?

=> What is the use of these folders ?

=> Can we move it to the dedicated folder I created for DLP ?

Thanks in advance for your help

Regards

Hello,

there are standard directories of DLP probes (network, discover, endpoint). I never try to move them to any other directory but it should be possible as they are defined in configuration file.

 Regards.

Thanks for your answer.

Is the configuration options on the Enforce or locally on the Endpoint ?

are you seeing these folders on DLP endpoint agent?

is this detection server with single tier?

We still don't have clients.. So we can only see this on the Endpoint server now.

This server is just Endpoint, Enforce is on another server.

yeah , these folders are found on detection servers .

\drop

\drop_pcap

Its normal to find these folders on detection servers because the software is the same for each detection role so the installer sets up those folders to be ready for any detection role. The detection server is assigned a role by the Enforce server when it is added to the console. The drop folders are there so you can test event types during troubleshooting. If you want to change the folder locations you can by changing the appropriate lines in the Protect.properties file.