Create Automatic Response from DLP Event

[admin2215]

I am trying to create an automatic event based upon a DLP event (USB being plugged in.) So far I have not been successful. I have tried setting the Event group to "ePO Notification Events" with an event type of "Client." For filtering I am setting event description to "Device Plug." I have also tried a few other combos, but none have been successful in generating an automatic response. Can anyone advise me on how to go about this? Thank you.

[cdinet]

Have you tried it as threat event instead of client?  I am not sure exactly what type event that is since I don't support dlp.

[admin2215]

I have tried that (unsuccessfully), but I will try again with some different filters applied. Thanks for the suggestion. I will let you know if it works. 

[cdinet]

You can try event ID too, other wise you might also want to ask the dlp team.

[admin2215]

So I did think about that, but I don't know how to get the event ID. Would you be able to give any info on this? Thanks again. 

[cdinet]

Is there an event in epo for it when you look at dlp events?  If so, that should have an event id in the event.  Otherwise, you will have to ask dlp team.

[admin2215]

I do not see an event outside of the DLP incidents. I am starting to think it is not possible to trigger an automatic response based on DLP events.

[SCtbe]

Seems to work fine for me (ePO 5.10 U10, DLPe 11.6.400), but you have to be precise on Threat Event fields content.

Note that Automatic Responses works on normalized DLP events, these you can point with ePO Notification Events > Threat in automatic response builder.

Details or how actually DLP events are normalized into ePO Threat event can be found under Reporting > Threat Event Log.

I've tried with Event id, where for Web Protection rule is 19114. Others fields probably can be also used but you have to look over them, because, they may change for example depending on actual rule names and action taken. Nevertheless you find examples in Threat Event Log.

[admin2215]

Thanks for your reply. I have review the log quite thoroughly and I see nothing related to DLP regarding USB mass storage events. I see a large number of events from solidcore, and also some events regarding malware findings (part of our testing) but nothing else. 

[SCtbe]

I'm not sure how you configured  DLP Rules, but in my case all incidents visible in DLP Incident Manager are also present in ePO Theat Event Log. That include also Device Plug incidents: