0 Replies Latest reply on Feb 24, 2010 2:22 AM by geek

    Problem with Web Post protection rule with Indexed data

    geek

      Hi all !

       

      I'm having  problems with the control of indexed documents in the web post  protection rule.

       

      I'm will try to describe the sequence of actions:

       

      1. Create registered documents repositories rule with local documents folder path (for example c:\index docs\)

      2. Copy to c:\index docs file SQL2005SecBestPract.doc wich contain 30 pages

      3. Create registred documents classification rule wich included repository from step 1 and classify

      4. Create server task with  DLP Register Documents Scanner action and run it

      5. In server task log  I'm see that the  task is done and document indexed wit SUCCESS status

      6. Create task "Deploy indexes to client" with type "Product deployment" and products and components are "DLP registered documents 9.0.0.0" (Run immediately)

      7. Wake Up clients mashine (Indexes  copied to the workstation)

       

      After that I'm create two simple protection rules (web post and e-mail) that blocked to transfer data with indexes content category.

       

      Discription
      E-Mail Protection rule
      Web post protection Rule
      1. Sent a message with a arbitrary  text (in attach SQL2005SecBestPract.doc file)The message was blocked (In DLP Monitor evidence with associated tag - "Index doc")The message was blocked (In DLP Monitor evidence with associated tag -  "Index doc")
      2. Sent a message with a first five pages of SQL2005SecBestPract.doc in a body of message (More then 400 characters)The message was blocked (In DLP Monitor evidence with associated tag -  "Index doc")The message was sent successfully !?!
      3. Sent a messagw with all pages from SQL2005SecBestPract.doc in a body of messageThe message was blocked (In DLP Monitor evidence with associated tag -  "Index doc")The message was sent successfully!?!

       

      Have you  met such a problem? or I am doing somthing wrong?

       

      PS:

      McAfee Host DLp Full License 9.0.0.403 on epo server

      MA 4.5 and HDLP client 9.0.0.416 and IE 8.0 on a workstation (Win7 and WinXPSP3)

       

       

      PSS: Sorry for my  terrible English.

       

       

      Message was edited by: geek on 2/24/10 11:22:22 AM GMT+03:00