Protection rule is triggered on a document that's unexpectedly tagged
Last Modified: 2023-05-23 04:37:48 Etc/GMT
Environment
For supported environments, see KB68147 - Supported platforms for Data Loss Prevention Endpoint.
Summary
- Tagging
- Content Classification
If a Protection Rule triggers unexpectedly on a document, it's possible to determine if the document is tagged by inspecting the Manual Tagging mechanism. For more information, see the Product Guide. If a document has been confirmed as being tagged, there are five possible ways in which the document is tagged:
- Application-based tagging rules apply tags generically in one of two ways. It applies tags based on the application or applications that create a file, as specified in application definitions, or based on the file type or file extension. You can also add text patterns and dictionaries to further restrict how the tags are applied.
- Location-based tagging rules apply tags based on the location of the source file. For example, a file being copied locally from a share on a network server. You can add text patterns and dictionaries as well to further restrict how the tags are applied.
- Tags can be applied manually via Manual Tagging.
- Tags can be applied during the Discover Process.
- Tags propagate via the DLPE software. This software tracks data transformations and maintains the classification of the sensitive content persistently, regardless of how it's being used. For example, if an application reads a tagged document and then later saves a file elsewhere with a few paragraphs of the same content.
Solution
Unless something else is changed in the policy, it's likely that whatever behavior led to the initial tagging can happen again. So, make sure that the users with the Manual Tagging capability are aware not to tag documents that aren't intended to be protected. Also, any copy from a location specified in a
The following is an example of how a new or recently reset tag can spread in an environment:
A Location-Based tagging rule is used. An application on a host with DLP Endpoint, without alerting the user, automatically reads a file from a location, such as a
To find out in more detail how a new or recently reset tag is multiplying in an environment, use the Log All Messages option. Use this option on all users that have Manual Tagging rights to read from a share specified in a
The following sample log shows how to determine when files are tagged:
NOTE: The logfile name is
In the following example, the file named
18:5:44:388 [2584] [ODEBUG] [File Tracker] [FileContentAccessedEvent::startProcessEvent] FAcc.FF#000183 start event handler file : \\grepo5\grshare\notepadtest.txt
...
18:5:44:388 [2584] [ODEBUG] [File Tracker] [ExtendedAttributesService::setFileTags] Setting file c:\users\administrator\desktop\notepadtest.txt extended attributes source tags(1)
16:52:23:904 [4728] [ODEBUG] [File Tracker] [FileContentAccessedEvent::startProcessEvent] FAcc.FF#000582 start event handler file : c:\users\administrator\desktop\notepadtest.txt
...
16:52:23:920 [4728] [ODEBUG] [File Handler] [FileFilterHandler::onOpen] File open for PID(4928) write c:\users\administrator\desktop\notepadtest - copy (2).txt
...
16:52:23:920 [4728] [ODEBUG] [File Handler] [WrittenFiles::insertWrittenFile] WRITE-BUFFER - file - c:\users\administrator\desktop\notepadtest - copy (2).txt PID(4928) pushed first time
...
16:52:23:920 [4728] [ODEBUG] [File Tracker] [FileContentTransmittedEvent::startProcessEvent] FTra.FF#000584 start event handler file : c:\users\administrator\desktop\notepadtest - copy (2).txt
...
16:52:23:920 [4728] [ODEBUG] [File Tracker] [ExtendedAttributesService::setFileTags] Setting file c:\users\administrator\desktop\notepadtest - copy (2).txt extended attributes source tags(1)
The following example shows pasting sensitive content into a document via
19:43:5:819 [2584] [ODEBUG] [File Handler] [WrittenFiles::insertWrittenFile] WRITE-BUFFER - file - c:\users\administrator\desktop\new text document.txt PID(2764) pushed first time
...
19:43:5:819 [2584] [ODEBUG] [File Tracker] [FileContentTransmittedEvent::startProcessEvent] FTra.FF#001193 start event handler file : c:\users\administrator\desktop\new text document.txt
...
19:43:5:819 [2584] [ODEBUG] [File Tracker] [FileContentTransmittedEvent::startProcessEvent] FTra.FF#001193 request text extraction filename(c:\users\administrator\desktop\new text document.txt)
...
19:43:6:115 [2584] [ODEBUG] [File Tracker] [ExtendedAttributesService::setFileTags] Setting file c:\users\administrator\desktop\new text document.txt extended attributes source tags(1)
Related Information
The whitelist folder contains text files defining content (typically boilerplate) that's not tagged and restricted. The main purpose of the whitelist folder is to improve the efficiency of the tagging process by skipping standard content that doesn't need to be protected.
For more information about how the Diagnostic Tool can be used to watch file tagging activity during a user logon session, see the Product Guide.
Affected Products
Languages:
This article is available in the following languages: