cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Former Member
Not applicable
Report Inappropriate Content
Message 1 of 6

Problems with clipboard rule DLP

Hello team!

 

I have a problem with the performance of the clipboard protection rule. I have DLP version 11.5.0.602 deployed on the agent and epo version 5.10.0. I have sorting configured for any document on a given network share, but when I open any of these documents it only triggers the DLP clipboard rule when I copy enough lines of the document at the same time. However, when I only copy 2 or 3 lines the protection is not triggered, why is this? How can I fix this so that the rule is triggered even if only one line of the document is copied. Thank you very much in advance.

5 Replies
Corey-DLP
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 2 of 6

Re: Problems with clipboard rule DLP

Hello and thank you for posting here!

For the classification used in your Clipboard Protection rule, is it configured to use Content Fingerprinting or Content Classification? If it's Content Fingerprinting, it's possible the data you've tested with does not meet the minimum amount of content required to trigger an incident. KB53436 contains details regarding this.

Former Member
Not applicable
Report Inappropriate Content
Message 3 of 6

Re: Problems with clipboard rule DLP

Hi Corey,

Indeed, in my clipboard protection rule, it was configured to use content fingerprinting and that is possibly why when the 350 copied characters were not reached the clipboard protection rule was not activated.


Would it be possible to create a rule configured to use content classification that captures any number of characters less than 350 and that in turn this capture comes from documents extracted from a shared network folder?


Is there any knowledge document describing the way in which a clipboard protection rule or screen protection rule based on content classification criteria comes into action?

Thank you very much for your attention and quick response.

 

Corey-DLP
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 4 of 6

Re: Problems with clipboard rule DLP

Unfortunately, the 350 character minimum is hard coded and can not be modified. That said, you should be able to use content classification criteria to trigger on smaller amounts of content through the use of words/phrases in dictionaries and advanced patterns. 

We do have a few KB articles on the functionality of the clipboard and screen capture protection rules. When protecting individual files against screen captures, the file itself does need to have a tag imbedded for the rule to work. This is detailed in KB85939. Additionally, these rules rely on the PID of the program being monitored. This is mentioned in KB85654. Lastly, I'd recommend looking at KB93054 (Registered) which talks about the proper configuration needed for using location based content finger printing with a clipboard protection rule. The 350 character minimum would still apply here, but the configuration mentioned would still be required.

Former Member
Not applicable
Report Inappropriate Content
Message 5 of 6

Re: Problems with clipboard rule DLP

Hi Corey,

Thank you very much for all the information provided.

There is something I don't understand and I can't find any information about it. I would like to be able to enable the clipboard rule to be triggered when less than 350 characters are copied.

I can't find information for using the content classification criteria to trigger on smaller amounts of content by using words/phrases in dictionaries and advanced patterns or based on other criteria.

Is there any documentation on this or are there any examples to make this clipboard rule work by copying less than 350 characters based on the use of words/phrases in dictionaries and/or advanced patterns?

Your information is really appreciated.

 

Former Member
Not applicable
Report Inappropriate Content
Message 6 of 6

Re: Problems with clipboard rule DLP

 

Hi Team,

I am still waiting for your reply to my last comment.

Thank you very much for all the information provided.

 

There is something I don't understand and I can't find any information about it. I would like to be able to enable the clipboard rule to be triggered when less than 350 characters are copied.

 

I can't find information for using the content classification criteria to trigger on smaller amounts of content by using words/phrases in dictionaries and advanced patterns or based on other criteria.

Is there any documentation on this or are there any examples to make this clipboard rule work by copying less than 350 characters based on the use of words/phrases in dictionaries and/or advanced patterns?

 

Your information is really appreciated.

You Deserve an Award
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community