cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Highlighted

Cannot decrypt selected events in DLP monitor

Hi,

I am struggling a little bit with evidence in DLP.  I have another question posted, but please disregard my issues with that as I have a temporary workaround for the purposes of testing.

Evidence is being reported back and being saved on the servers c:\evidence folder.  However, within the monitor, I cannot decrypt the selected event as the option is greyed out.  What could be causing this?  I am a global administrator so this shouldn't be a permissions issue?

http://i39.tinypic.com/vgk5g1.png>

As a side note, if the evidence was being stored on a seperate server (that wasn't running EPO or hosting DLP or it's database), how would I go about decrypting the evidence?

Many thanks

6 Replies
Highlighted
Reliable Contributor
Reliable Contributor
Report Inappropriate Content
Message 2 of 7

Re: Cannot decrypt selected events in DLP monitor

I see you posted a lot of questions lately - maybe it would be good for you to engage your support team and get some help setting up DLP? There's only so much help you'll get within the Community, as we are all volunteers here, not professional support?

Highlighted

Re: Cannot decrypt selected events in DLP monitor

Point taken, thanks anyway

Highlighted
Reliable Contributor
Reliable Contributor
Report Inappropriate Content
Message 4 of 7

Re: Cannot decrypt selected events in DLP monitor

np - I am not an expert, but I thought that the evidence folder had to be a UNC path? It's a long time since I looked at this though.

Highlighted
Level 10
Report Inappropriate Content
Message 5 of 7

Re: Cannot decrypt selected events in DLP monitor

With the event highlighted the evidence link will be on the right-hand side at the end of the pane. Double-click the evidence to open it. Now if that fails you can right-click and choose 'copy'. Paste into notepad and the data related to that evidence file will be revealed. Try and navigate to the link you just pasted and any problems accessing the file will be apparent.


Best Regards

Chris Norris, CISSP
McAfee Tier III Support Engineer
Data Loss Prevention Endpoint

DLPE Troubleshooting Tree: https://kc.mcafee.com/corporate/index?page=content&id=PD23517

McAfee website: www.mcafee.com
McAfee Corporate Online Support (Service portal): http://www.mcafee.com/us/enterprise/support/index.html

Message was edited by: cnorris on 22/12/11 08:34:05 CST
Highlighted

Re: Cannot decrypt selected events in DLP monitor

Chris, very helpful indeed, thankyou.  It has also answered my question of how to 'import' evidence from another location.

Highlighted
Reliable Contributor
Reliable Contributor
Report Inappropriate Content
Message 7 of 7

Re: Cannot decrypt selected events in DLP monitor

Are you trying to import data from evidence or decrypt to read the contents? Are you able to decrypt from DLP Prevent incident or better stil explain your setup. I have similar issues and was able to resolve by 1. making sure the share evidence is set in server configuration and client settings, 2. test the connection and make sure it all correctly connected, also 3. check the permission on the evidence share folder and make sure the ePO computer account has RW access from security group settings.

You Deserve an Award
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community