DLP device control logs

[ghunjan]

Hi folks,

Could someone please advise where can I find the DLP device control Incident logs. 

If they are in DB, what is the SQL statement to fetch them.

Thanks,

Gagandeep

[Hem]

DLP incidents will be logged under DLP Incident manager (Menu->data protection->DLP incident manager). You can see the events here.

There  are many default DLP queries related to dlp incident. You can use them or can create new query from available 'Queries and reports'.

[ghunjan]

I'm looking to get the location of these events in form of Logs or SQL statement to fetch them if they are in a DB.

[DLP_RS]

Hi Gagan,

All types of DLP incidents are available for review under DLP Incident Manager. All you need is to refine the default settings for specific types of incidents. For example--

1. In McAfee ePO, select DLP Incident Manager.
2. From the Present drop-down list, select the option for your product.
3. Perform any of these tasks.
   • To sort by column, click a column header.
   • To change columns to a custom view, from the View drop-down list, select a custom view.
   • To filter by time, from the Time drop-down list, select a time frame.
   • To apply a custom filter, from the Filter drop-down list, select a custom filter.
   • To group by attribute:
     1. From the Group By drop-down list, select an attribute.

        A list of available options appears. The list contains up to 250 of the most frequently occurring options.

     2. Select an option from the list. Incidents that match the selection are displayed.

[ghunjan]

Hi DLP_RS,

Thanks for this information. I'm aware of it.

The reason why I'm looking to find the log location or SQL statement to fetch them is because, we are having issue with a particular brand of External HDD which is not getting detected by the Agent so that we can whitelist or allow in on the DLP Manager. We have also tried to get second External HDD of same brand and it was not detected by the DLP Device Control. I can see events being sent to the ePO but I do not see anything on the DLP manager.

So, this is why I wanted to find the location of logs and see what is the issue? Why that external HDD is not seen on the DLP Manager.

[DLP_RS]

Hi Gagan,

If I understand correctly, it is an issue in blocking an external HDD. I have few suggestions.

1. Make sure that you are using DLP 11Patch 1 latest update.

2. Also review the KB-

How to block a Seagate hard disk drive in Data Loss Prevention Endpoint

Technical Articles ID:   KB90900

https://kc.mcafee.com/corporate/index?page=content&id=KB90900

If the issue still persists, please log a service request with McAfee Technical Support.

[ghunjan]

Hi DLP_RS,

It is an issue when external HDD is not getting detected.

Thanks,
Gagandeep

[DLP_RS]

The client side DLP logs are located at-

C:\ProgramData\McAfee\DLP\Temp

Use DLP Diagnostic Tool will also help here.

[Mreaden]

ghunjan Report,

In EPO, you should be able to see the incidents in the Incident Manager. Go to Menu, under Data Protection column, select DLP Incident Manager. There you should see a list and a graphical representation of all incidents, including Device Control incidents.