Symantec DLP Edpoint Prevent no detecta incidentes al enviar archivos .zip o .rar en Hotmail

Question

Hola a todos.
Tengo instalado varios agentes de Symantec DLP 11.5.1 que reportan al modulo de Endpoint Prevent, tambien se configuro una politica de prueba.
El problema es que al enviar un archivo .zip&nbsp;o .rar que contenga otro archivo&nbsp;con información confidencial como esta configurado en la politica, no se detecta ningun incidente, pero esto solo ocurre cuando el archivo&nbsp;es enviado desde&nbsp;Hotmail, de algún otro correo WEB si es detectado.
¿Endpoint Prevent no es compatible con Hotmail o acaso Hotmail actualizo su pagina ultimamente?
&nbsp;
La configuración de los agentes es la siguiente:
&nbsp;
Name  Description

Agent MonitoringAgent ConfigurationAdvanced Agent Settings
		&nbsp;

Enable Monitoring

Select the channels to monitor

Destinations

&nbsp;Removable Storage

&nbsp;CD/DVD

&nbsp;Local drive

&nbsp;Printer/Fax

&nbsp;Clipboard

Email

&nbsp;Outlook

&nbsp;Lotus Notes

Web

&nbsp;IE(HTTPS)

&nbsp;Firefox(HTTPS)

&nbsp;HTTP

&nbsp;FTP

Instant Messaging

&nbsp;AIM

&nbsp;MSN

&nbsp;Yahoo Messenger

Applications

&nbsp;Application File Access

Network Shares

&nbsp;Copy to local drive

&nbsp;Copy to share

Filter by File Properties

Add filters here to optimize monitoring. Filters tell the agent to monitor or ignore files based on protocol, destination, file size, file type, or file path.
							Filters run in the order they appear. A file is ignored or monitored based on the action of the first filter that it matches.
							You can change the order that filters run by changing the numbers in the Order column.

&nbsp;

Add Monitoring Filter

Order
						Actions
						Destination
						File Attributes
						&nbsp;

&nbsp;
						Monitor
						Application File Access, CD/DVD, Email Attachment, FTP transfer, HTTP/HTTPS Attachment, IM File transfer, Removable Storage

size
										&gt;
										1 &nbsp; KB

type
										=
										*.doc , *.docx , *.jar , *.mpp , *.pdf , *.ppt , *.pptx , *.rar , *.txt , *.wcm , *.xls , *.xlsx , *.zip

&nbsp;

&nbsp;
						Monitor
						CD/DVD, Email Attachment, FTP transfer, HTTP/HTTPS Attachment, IM File transfer, Removable Storage

size
										&gt;
										1 &nbsp; KB

type
										=
										.zip, .rar, .doc, .xls

&nbsp;

&nbsp;
						Ignore
						Local Drive, Removable Storage

type
										=
										*.v2i , *.vmdk , *.vmem

&nbsp;

&nbsp;
						Ignore
						Application File Access, CD/DVD, Local Drive

type
										=
										*

&nbsp;

Specify Default File Filter Action

The following action will be applied to any file that does not match any of the file filters configured above:

&nbsp;Monitor

&nbsp;Ignore

Filter by Network Properties

Specify Network filters here to optimize monitoring. These filters will tell the Agent to monitor or ignore network traffic based on IP addresses or domain names.

&nbsp;

IP Filters:

IP

&nbsp;

Domain Filters:

HTTP

HTTPS

&nbsp;
&nbsp;
&nbsp;

kdashtobi · Answer

Como dato adicional al enviar un correo adjuntando un archivo en su formato original (.txt, .xls, .doc) desde la pagina de Hotmail este si es detectado como incidente pero al enviar el mismo archivo en un formato rar no en detectado como incidente

Forum Discussion

Symantec DLP Edpoint Prevent no detecta incidentes al enviar archivos .zip o .rar en Hotmail

Related Content

Backup mediante Bit de archivo Linux?

Symantec Data Leakage

Symantec AppHA doubt

Symantec Security.

Symantec licenses

Recent Discussions

Looking for NetBackup partner in Eastern ontario

Partner Engage - Marketing Tool

SDRK for Enterprise Vault (Service Delivery Resource Kit)

Netbackup cleanup job pass with code 0 but no images has been deleted

Netbackup Catalog Recovery - Linux Redhat -EASY?

Filter by Network Properties
Specify Network filters here to optimize monitoring. These filters will tell the Agent to monitor or ignore network traffic based on IP addresses or domain names.

IP Filters:
IP

Domain Filters:
HTTP
HTTPS