Data Loss Prevention

Expand all | Collapse all

Web Prevent Incidents - Custom Attributes - Script not working

Jump to Best Answer
  • 1.  Web Prevent Incidents - Custom Attributes - Script not working

    Posted 8 days ago
    Edited by Muhammad Atif 8 days ago
    Hello,

    Web Prevent provides sender information in this format 'WinNT:\\domain\username'

    I am using this script 'Webprevent_script.vbs' to remove WinNT:// and pass the remaining information to LDAP plugin to populate custom attribute fields.

    In my case it is only working for HTTP, not for HTTPS incident

    I am attaching Webprevent_script and LDAP plugin text for your review.

    Need your support. Thanks

    BR
    Atif

    Attachment(s)

    txt
    LDAP_Plugin.txt   1 KB 1 version


  • 2.  RE: Web Prevent Incidents - Custom Attributes - Script not working

    Posted 7 days ago
    Hi,

    It is working for HTTP and FTP because of the following line in the script. Try to add HTTPS as a condition too.

    If attributeValues(1) = "HTTP" OR attributeValues(1) = "FTP" Then



  • 3.  RE: Web Prevent Incidents - Custom Attributes - Script not working

    Posted 7 days ago
    Hi,

    I made this change
    If attributeValues(1) = "HTTPS"
    But still not working.

    BR
    Atif


  • 4.  RE: Web Prevent Incidents - Custom Attributes - Script not working

    Posted 7 days ago
    Edited by Barnabas 7 days ago
    Try with this one

    If attributeValues(1) = "HTTP" OR attributeValues(1) = "HTTPS" OR attributeValues(1) = "FTP" Then
    However scripting always needs some testing ands customization, especially if you are using a script from someone else.
    Do some vbs debugging in your environment.

    You can do testing like this:

    C:\>cscript.exe //nologo "C:\webprevent_script.vbs" sender-email=WinNT://AD-domain/userID protocol=HTTPS
    HTTPUserName=userID​
    Please mark SOLVED if helped!


  • 5.  RE: Web Prevent Incidents - Custom Attributes - Script not working

    Posted 7 days ago
    Hi Barnabas,

    I made this change in the script

    If attributeValues(1) = "HTTP" OR attributeValues(1) = "HTTPS" OR attributeValues(1) = "FTP" Then
    still HTTPS incident Custom Attributes are not being populated.

    Moreover, I performed the testing and getting the below result:

    C:\Windows\system32>cscript.exe //nologo "C:\Program Files\Symantec\DataLossPrevention\EnforceServer\15.8.00000\Protect\plugins\NPW04_Script.vbs" sender-email=WinNT://imlab.local/m.atif protocol=HTTPS
    HTTPUserName=m.atif

    BR
    Atif



  • 6.  RE: Web Prevent Incidents - Custom Attributes - Script not working
    Best Answer

    Posted 6 days ago
    Hi,

    I reviewed the localhost logs and made a change i.e. HTTPS to HTTPS/SSL. It worked.

     

    If attributeValues(1) = "HTTP" OR attributeValues(1) = "HTTPS/SSL" Then


    Barnabas: Thanks for the support

    BR
    Atif