cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Highlighted

DLP endpoint -Device control - Alert " BL|MON|NTFY|ON"

Hi Support Team,

Does anyone know about this event in the DLP-  "BL|MON|NTFY|ON"?

 

-Mukesh

 

11 Replies
Highlighted
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 2 of 12

Re: DLP endpoint -Device control - Alert " BL|MON|NTFY|ON"

Hi @mukesh13m ,

Thank you for writing in here.

Can you help us with a screenshot for better understanding.

 

Regards,
Jithendran S
McAfee Employee
Highlighted

Re: DLP endpoint -Device control - Alert " BL|MON|NTFY|ON"

Thanks @jsubbura for a quick response - here is the threat even and if you see threat action - what that mean -

Server ID: xxx
Event Received Time: 29/04/20 23:14:42 CDT
Event Generated Time: 29/04/20 23:13:24 CDT
Preferred Event Time: 29/04/20 23:13:24 CDT
Agent GUID: C5E936EA-1F6B-xxx-xxx-000000000000
Detecting Prod ID (deprecated): DLPAGENT114
Detecting Product Name: Data Loss Prevention
Detecting Product Version: xxx
Detecting Product Host Name: xxx
Detecting Product IPv4 Address: xxx
Detecting Product IP address: xxx
Detecting Product MAC Address:
DAT Version:
Engine Version:
Threat Source Host Name: xxx
Threat Source IPv4 Address: xxx
Threat Source IP address: xxx
Threat Source MAC Address: xxx
Threat Source User Name: xxx
Threat Source Process Name:
Threat Source URL:
Threat Target Host Name: xxx
Threat Target IPv4 Address: xxx
Threat Target IP address: xxx
Threat Target MAC Address: xxx
Threat Target User Name: xxx
Threat Target Port Number:
Threat Target Network Protocol:
Threat Target Process Name:
Threat Target File Path:
Event Category: Policy
Event ID: 19115
Threat Severity: Error
Threat Name: Windows PNP SmartPhones Block
Threat Type: [DLP] Device Plugged Protection
Action Taken: BL|MON|NTFY|ON
Threat Handled:
Analyzer Detection Method: DLP for Windows
Events received from managed systems
Event Description: Device Plug

-Mukesh

Highlighted
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 4 of 12

Re: DLP endpoint -Device control - Alert " BL|MON|NTFY|ON"

HI @mukesh13m ,

Thank you for the details,

What is the Reaction Configured for the Rule "Windows PNP SmartPhones Block", can you attach a screenshot from the Reaction tab for this rule.

 

Regards,
Jithendran S
McAfee Employee
Highlighted

Re: DLP endpoint -Device control - Alert " BL|MON|NTFY|ON"

Thanks for the replied. 

i have attached the screenshot of the policy in reaction- Thanks 

Mukesh

 

Highlighted
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 6 of 12

Re: DLP endpoint -Device control - Alert " BL|MON|NTFY|ON"

Hi @mukesh13m ,

I did multiple testing in my Lab with DLP 11.3, 11.4 and I was unable to see anything under the action taken field under Threat events.

Can you let us know what is the version of DLP installed on the client machine which is generating these events, MA version and do you have VSE or ENS? If so kindly let us know their version.

And also the DLP extension version in EPO.

 

 

Thank you.

Regards,
Jithendran S
McAfee Employee
Highlighted

Re: DLP endpoint -Device control - Alert " BL|MON|NTFY|ON"

Thanks, 

I am using DLP endpoint 11.4 and when users are connected their phone into the machines and that error message occurred in the events.Thanks

Highlighted

Re: DLP endpoint -Device control - Alert " BL|MON|NTFY|ON"

Thanks, 

did you try test to connect to your phone in your machines? I am using DLP endpoint 11.4 and when users are connected their phone into the machines and that error message occurred in the events. thanks 

Highlighted
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 9 of 12

Re: DLP endpoint -Device control - Alert " BL|MON|NTFY|ON"

Hi @mukesh13m ,

When i tested with the Reaction as block i did see Action Taken as "BL|MON|NTFY|ON", I am checking on this Internally and would come back to you in some time.

 

Thank you.

Regards,
Jithendran S
McAfee Employee
Highlighted

Re: DLP endpoint -Device control - Alert " BL|MON|NTFY|ON"

Hi, 

any updates?

Mukesh

You Deserve an Award
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community