DLP Agent issue - HTTPS incidents are not being tracked by DLP console

[Rogier Van.de]

Hello All,

We have an issue with DLP 15.5 where we are unable to find the HTTPS incidents in DLP console.

However, HTTP is being tracked and incidents getting logged in console.

Anyone come across this issue.

Thanks in advance
R V D

------------------------------
Rogier Van De
------------------------------

[Joris Kieffer]

Hello,

which navigator are you using ? I have this issue with Chrome and it is maybe an incompatibility between the agent and a version of Chrome.

Could you try from a different navigator like IE or Edge ?

Best Regards

[Rogier Van.de]

Hello Joris,

Tried with browsers Chrome, Edge and Explorer, HTTP traffic is getting captured in console but not the HTTPS traffic for all 3.

Thanks
Rogier.

[Joris Kieffer]

Hello,

did you configure the monitoring of "HTTPS" for these differents browser in the agent configuration ? By default I think that only the http is configured ?

Best Regards.

[Rogier Van.de]

Hello Joris,

Yes,  we have configured the for all 3 browsers. Still the same issue.

Thanks,
Rogier

[Rogier Van.de]

Hello,

Support is not responding to the issue properly,

When I collected the Fines t logs I see the below logs, Anyideaon this

|  6384 | FINEST  | CodeInjection.HookManager | Session 0: LoadLibrary execution failed in process: Pid->684 ProcessName->C:\Program Files (x86)\Google\Chrome\Application\chrome.exe | DllHooker.cpp(649
|  6384 | FINEST  | CodeInjection.HookManager | Session 0: LoadLibrary execution failed in process: Pid->5776 ProcessName->C:\Program Files (x86)\Google\Chrome\Application\chrome.exe | DllHooker.cpp(649)

1756 | FINEST  | ApplicationState.ApplicationStateService | Request received from 6032_8641e746_C:\Program Files\Manufacturer\Endpoint Agent\brkrprcs64.exe

1756 | FINEST  | ApplicationState.ApplicationStateService | Updating state  ACTIVE_URL for process 7900 with state data chrome://extensions/?id=eelojgpfkmhiikmhkineneemcahoehjo;

 | 11996 | FINE    | Chrome.ChromeConnector | Connection from 7900_4cd680c2_C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

07/15/2020 13:36:31 | 11996 | FINEST  | Chrome.ChromeConnector | <DLPBrowserRequestMarshallable>

                <URL type=String>https://dlptest.com/https-post/</URL>

                <content type="DLPContentMarshallable">

                                <DLPContentMarshallable>

                                                <key type=String>2430A7FE23C12054D641A7F424F6FB6D7F24281174C1EC78D902087A8FDC2B9FB3717821ADB13EEDE929E8D45B0F0BF20DA09EE931699C855DE60A06FCDEEF23</key>

                                                <isComplete type=boolean>1</isComplete>

                                </DLPContentMarshallable>

                </content>

</DLPBrowserRequestMarshallable>

 

| 11996 | FINEST  | AgentServices.PreFilterConfiguration | Matched domain filter .* Action: Ignore

11996 | FINEST  | InternetExplorer.IEConnector | Domain Filter matched for dlptest.com. It will not be monitored. | DLPChromeServer.cpp(387)

11996 | FINE    | Chrome.ChromeConnector | Disconnection from 7900_4cd680c2_C:\Program Files (x86)\Google\Chrome\Application\chrome.exe