HTTP Request Payload.txt Alerts?

[DV_BB]

Hello,

We recently deployed McAfee DLP to a large number of our endpoints and are starting to adjust the policies.  Something we've noticed a lot of, are alerts that have an evidence name of; "HTTP Request Payload.txt".

When we review the alert, it indicates that there is corresponding data such as credit cards, etc.  My question is, are these typically noise and if not, is there a best practice to help adjust it accordingly?  Thanks in advance

[Corey-DLP · Accepted solution]

Hello and thank you for posting here! 

The HTTP Request Payload.txt files are legitimate uploads to a web server, but are generally not uploads conducted by an end-user. They are typically the result of the browser using web post methods such as AJAX/Web requests in the background. These events are often captured by DLP when a Web Post Protection rule is configured too broadly. KB92682 has some further details. 

Regarding the credit card numbers you're seeing in these files, this is likely a numeric string that is matching one of the credit card regex patterns. While the number may validate against the regex pattern, the number is most likely not intended to be a credit card number. Often these types of background web requests will contain numeric strings that are similar to credit card numbers, social security numbers, etc. 

There are essentially two ways to work around this. The first would be to modify the classification used in the Web Post protection rule so that the scope of the data it is searching for is more narrow. If this is not possible and it is deemed that these HTTP Request Payload files are not considered to be a data loss vector in your environment, these incidents could be purged by configuring a purge task in your incident manager which would look for these evidence files.

[DV_BB]

@Corey-DLP 

Hello and thanks for the response. I'll look into modifying the classification.  Additionally, is it possible to set Thresholds for credit card number detections? So in other words, it seems that the rule is triggering anytime it detects a credit card number once in the payload.txt file; however can I simply change/set a threshold to 10, so that the rule will fire when it sees 10 credit cards instead of just 1?  If so, can you please advise where this is configured? I'm unable to find within the policy itself and/or classifications.  Thanks

[Corey-DLP]

You can absolutely modify threshold values. By default, they are all set to 1 for advanced patterns. You can modify this when editing your classification.  When you click the ellipses button (...) to add or remove advanced patterns in your classification, there is a threshold column which displays the threshold value for each definition. These values can be modified up to a value of 1000. I think this would be an excellent way to help reduce false positives. I've attached a screenshot of where the threshold settings can be found.

[DV_BB]

@Corey-DLP - Thanks for the information and help, very much appreciated!

[THolzemer]

What if, in the Web Post rule, I created an exception. In the exception I use a classification that is looking for File Information that references a definition that specifies the File Name = HTTP Request Payload.txt?

With that included in the Web Post rule that should ignore, or at least not generate an incident, for anything matching File Name = HTTP Request Payload.txt, correct?

Thanks!