DLP 15MP1 Endpoint Prevent with ICE integration. User has logged into ICE utility with their credentials and copied a file with sensitive information to a network share.
'Prevent: Encrypt' response rule supports Removable Media (USB) destinations for the ICE integration in DLP 15MP1.
Other channels, such as 'Copy to Network Share' and HTTPS (Chrome), will result in a block action to prevent the data from leaving the endpoint.
In order to utilize the ICE integration response rule, Prevent: Encrypt, without impacting normal business operations, a response rule conditon is required.
The response rule condition 'Protocol or Endpoint Monitoring' should be used in this case to allow the Prevent: Encrypt response rule to trigger when Removable Media channel is detected.
All other channels will not be affected by this response rule.
Subscribing will provide email updates when this Article is updated. Login is required.