cancel
Showing results for 
Search instead for 
Did you mean: 
btlyric
Level 12

Handling of Files -> DLP

Given a rule set where MWG will not send anything to a Prevent DLP appliance if it is over a defined size, how is that handled on the MWG side?

For example, if I have a rule that says Body.Size greater than X -> Stop Rule Set (before sending to DLP, how would an archive file that is greater than X, but contains components smaller than X be handled? Would the entire archive be skipped or would MWG send the files in the archive to DLP since they didn't meet the X size limitation?

If the former, is there a way to send the extracted file components to DLP without having them skipped?

0 Kudos
3 Replies
alexott
Level 11

Re: Handling of Files -> DLP

Hi

you're asking about built-in DLP functionality?

0 Kudos
btlyric
Level 12

Re: Handling of Files -> DLP

Network DLP using DLP Prevent via ICAP.

0 Kudos
McAfee Employee

Re: Handling of Files -> DLP

Hi btlyric!

MWG (should) only send whole objects to the ICAP server (in the request or response cycle), it does not send components it finds upon opening the object (in the embedded object cycle).

Best,

Jon

0 Kudos