Whitelist location

[skeating]

Hello

I am working in the Data Loss Prevention 11.4, and I cannot find the Whitelists for the client configuration, in the Policy Catalog. Is there somewhere else I need to be looking for this?

Thanks

[Former Member]

Hello @skeating 

Thanks for your post.

You can create whitelisted plug and play items in the Definitions → Device Control → Device Templates page in the DLP Policy Manager.

Try checking the above location.

Was my reply helpful?

If you find this post useful, please give it a Kudos! Also, please don't forget to select "Accept as a Solution" if this reply resolves your query!

[cdinet]

I am moving this to dlp where it belongs.

[jsubbura]

Hi @skeating ,

Thank you for writing in here.

There are 4 whitelists in windows client configuration policy, kindly let us know what do you want to whitelist in here? 

[skeating]

I need to put the chrome.exe in there so that there will be no problems with the DLP scans. From what I have found in my research, that needs to go in the Printing Protection, Web Protection, Clipboard Protection and Content Tracking. Attached is a screenshot of my Policy Catalog, which does not show these areas. I am wondering what I need to do.

[crathbor]

Based on your screenshot, you should be able to find the options for Printing Protection, Web Protection, Clipboard Protection and Content Tracking under the Windows Client Configuration section. First, expand the Windows Client Configuration section, then click edit on the policy you want to apply to your systems. Once there, you should see the options for Printing Protection, Web Protection, Clipboard Protection and Content Tracking under the settings column. It should look similar to the screenshot I've attached. For Printing Protection, Clipboard and Content Tracking you can exclude by process. However, for Web Protection, you can only exclude by URL. Excluding URLs is used for whitelisting specific domains in which you do not want DLP Web Protection Rules to analyze. 

[skeating]

Please see attached. I am not seeing the same thing as your attachment shows.

[Corey-DLP]

Since those options are not available, you likely have the Device Control Only DLP license added to DLP Settings. To validate this, in the ePO menu navigate to Data Protection > DLP Settings > General. In the License Key section you should see a module named McAfee DLP Endpoint. Under the module column does it say "Device Control" or "Data Protection and Device Control"? See attachment for an example. Also, is your plan to use DLP only to monitor/block hardware devices or data as well?

[skeating]

It does say Device Control. Do I have to purchase another license for the other capabilities? Initially I was going to only use this for device control and data as well.

[Corey-DLP · Accepted solution]

If the Device Control license is the only license key you see available in either the McAfee Agent Portal or Software Catalog in ePO, then yes you would need to purchase the license key that provides both Data Protection and Device Control capabilities. 

As a side note, with your current configuration, DLP is only operating at the hardware level and should not be interacting with any applications. As such, whitelisting applications in DLP would not be necessary.