Blocking File Uploads and false positives.

[Linuxxo]

Hello,

I have recently enabled a Rule to block All file uploads for any websites, and I have noticed a very large numbers of incidents raised when a user visits a number of well knows sites that do not offer upload options, like online newspapers and travel sites. The source of every incidents is always Internet Explorer (version 11 is the default one). Any ideas what may be triggering those false positives through IE? Is there anything that needs to be checked in order to reduce them?

Many Thanks

[DLP_RS · Accepted solution]

Looks like temporary internet cache files are being captured. Could you please follow the workaround mentioned in the KB:-

https://kc.mcafee.com/corporate/index?page=content&id=KB85726&snspd-1015

[Linuxxo]

Many thanks for your quick reply, that seems to be the right solution, however I am blocking all files and not using any custom Classifications. I guess that somehow I will have to figure out how to use the newly created Definition as per KB.

[Gedefort]

By the way, I also encountered such a problem, it turned out to be solved.

[Linuxxo]

Thanks a lot for your help. The solution has worked, however it needed some tweaks. The KB does recommend to set the file size to less than 1 KB, but in reality most of the files generating false positives are above that. Most of the files triggering the incidents were around 2 or 3 KB in size, with some up to 12 KB, so the value had to be increased to minimise false positives.