Blue Coat Data Loss Prevention (DLP)

 View Only

  • 1.  Blue Coat Data Loss Prevention (DLP) problem and End point Agent

    Posted Jan 24, 2020 07:03 PM

    Hello, 

    i'm in site for configuring the DLP polices and when i check the incedent of DLP Network prevent for web  i found the incedent without any attributes

    could you please advice me with the solution of this problem ?

     and i would like to ask about somthing like Bypassing the prevent action in endpoints if it exsist 

    and  how can i apply the policy immediatly on the agent because it take a several munites to restart when i restart the agent from the console ?

    Thankyou.

     



  • 2.  RE: Blue Coat Data Loss Prevention (DLP) problem and End point Agent
    Best Answer

    Posted Jan 25, 2020 07:41 PM

    Hi Mostafa 

    The below links will help you with the attributes.

    https://www.symantec.com/connect/forums/how-populate-web-prevent-incident-attributes-0

    https://www.symantec.com/connect/forums/how-integrate-ldap-identify-user-attributes-dlp-web-unique-id-being-dynamic-ip

    for bypassing the prevent action , There is a response call a user cancel which will show a popup to the user with allow or cancel , if the user clicked allow the action will not be blockd and an incident will be created on the DLP.

    to apply the policy immediatly , please follow the below link and change the number accordingly 

    https://support.symantec.com/us/en/article.tech233788.html

    below are the fields that you need to change it 

    EndpointCommunications.HEARTBEAT_INTERVAL_IN_SECONDS.int -- Default 270

    EndpointCommunications.IDLE_TIMEOUT_IN_SECONDS.int -- Default 30

    ServerCommunicator.CONNECT_POLLING_INTERVAL_SECONDS.int -- Default 900

    Hope this solves your problem 

     

     



  • 3.  RE: Blue Coat Data Loss Prevention (DLP) problem and End point Agent

    Posted Nov 09, 2020 03:55 PM
    Thanks for the update and quick reply. I'll be sure to keep an eye on this thread.
    Original Message