Good day! Someone has set up a lock on the title of the application window. I have a process loads a third-party addition using the operation QueryOpen. On the screen the message. The message window title is the same in any situation. I'm trying to set up a rule to block the appearance of this window. Tried to set a new Definition of application application name and window caption or title additions and window caption. The rule does not see the window. If you have any ideas?
As of now, DLP does not supports Thunderbird email client. Please find the list of DLP Supported softwares here https://kc.mcafee.com/resources/sites/MCAFEE/content/live/PRODUCT_DOCUMENTATION/24000/PD24527/en_US/...
I know that thunderbird is not supported DLP. But in Endpoint has the ability to Control applications. That is what I'm trying to do. To determine the application, you can create many options, but in my case, DLP does not see, when thunderbird brings up a window additions.
I looked through ProcessMonitor (Procmon.exe) the name of the process was: thunderbird.exe
But if you set the application definition: the process name thunderbird.exe and window name ... protection rule application fails.
There is no guesswork.
In Thunderbird the 'Window Title' characteristic changes depending on what you are doing.
If you open a blank email the title is 'Write:' and if you add a subject then it is 'Write: subject'
So to block app windows based on title you need to run ProcMon, add the Window Title column, then note down the title as you try each function.
As a result, I had to block the sending of messages via Thunderbird without regard to the recipient's address. I.e. I block a network connection, if you find the file with certain parameters, for example, a tag...
I need apply DLP policies for Thunderbird y Windows Live Mail clients...
We need apply restriction policies in DLPe v10.
Do you know if this task is possible? can't find info about this....
· Descripción de productos a instalar para la solución de EDR en las versiones recomendadas por McAfee: Debemos instalar los productos que ustedes nos indiquen en las versiones que recomiendan en nuestro laboratorio.
· Configuración recomendada por la marca para estos productos: Una vez instalada la suite se debe configurar según la recomendación de la marca, ya que una vez configurada, nosotros no modificaremos las políticas y realizaremos las pruebas con la configuración establecida.