So am wondering if anyone has seen this berfore.
We have DLP 9.3 and EPO 5.1
When we created a rule for web post and using Drop box, we noticed that we get one notification for a file and then if we re-copy the same file to the drop box the notifications stop. To get the notification or the rule to work again, we have to change the name of the file. the tagging rule seems to work for one time only with the same file name.
Copy test.txt to dropbox = Notification
Copy test.txt to dropbox again = no notification and no entry in DLP incident manager. tried this 5 times same result
Copy test.txt to drop box and get message that file exists. Use Copy and replace file and get no notification
Copy test.txt to dropbox and gt message that file exists. Select make copy(last option) and now we get notification.
I copied the file in explorer and it will not work.
Has anyone seen this before?
Also noticed that the DLP add on in outlook seems to get disabled a lot due to timeout.
In 9.3 there is a Popup Aggregation feature that shows only one popup if multiple incidents were generated in a short span of time.
Did you cross check whether there was an equal number of incidents in the Incident Manager?
Reg. the Outlook add-on issue, work with McAfee Support. Sounds like a bug to me.
Some file hosting solution normally check for the file hash prior to upload.
If you have to upload the same file , the actual POST activity does not happen hence you wont get the pop up.
Do a check with wireshark if this is the case for dropbox as well.
I trust you are using the Dropbox apps on your PC?