I have a Removable Storage protection rule for all Removable storage which is "Monitoring File transfer of office files and PDF". This is working correctly and sending the events to EPO when these file types are copied.
When I start to test copies of large numbers eg - 3000 to 5000 files this is taking huge amounts of time even before the transfer starts. I think this is down to the Content Classifier and Text Extractor settings but the time its taking doesn't seem reasonable. This is still also an issues when I do an Agent Bypass and try the copy.
DLP popup states Files are being Analyzed....(which only lasts 5 secs with no option to extend.....
Note - I don't have the policy set to store evidence at this stage only monitor (this is enough for us currently as the event has the file name listed and this can be exported and checked)
We do have cases where people need to copy large amounts of files to Approved Storage by the time its taking seems unreasonable.
This was never an issue in DLP 9,3 - The file transfer would begin immediatly and the events and data would still send to EPO and be recorded (monitoring only with no evidence storage)