Data Loss Prevention - can't get policy to work

Question

Hi, 
 thanks for helping: 
 I am currently testing the DLP features of Sophos Endpoint but can't get any rule to work. I have even established a file based rule which I would expect to trigger in any case: 
 
 Allow transfer if user confirms 
 File type matches: spreadsheet 
 Destination is: [everything; email client, storage, voip, etc.etc] 
 Action: Allow transfer if user confirms 
 
 I have tried copying around a spreadsheet (xlsx) with sample data (to a removalble drive, USB, E-Mail-Message, Signal Messenger) and there's no reaction, pop-up, message or whatever. 
 
 I have checked the user: policy applied and enforced 
 I have updated the Sophos Endpoint Client and checked with the self-help tool: Updates/Policies applied 
 
 What am I missing here? Do DLP policies need some time until they are triggered or become fully active? Does implementing a policy need a reboot to activate the policy? I'm really frustrated.

Foxbot · Accepted Answer

I did a full reboot now (2022-12-17, 05:32 am) and this is what I see: 
 
 There is a file_rule now for spreadsheets - but the regkey says it is from 202212162100.... Still, the Endpoint's Self Help Toll states under "Policies" that Sophos Adapater received policies last at Dec 16, 22:00:57. 
 Furhtermore, even with this policiy - I suspect it shall trigger everytime a spreadsheet is copied around or tried to attach to an e-mail (I use Outlook) in any way - nothing happens (no pop-up, no alert in Sophos Central or at the Endpoint).

Qoosh · Answer

I am able to replicate this issue as well. The Outlook app does not generate the prompt to allow/block the transfer, whereas transferring files to removable media does. 
 I'd suggest raising a support case in relation to this issue. If you can provide me with your case ID via private message, I can follow up to add notes based on our findings here as well.

Data Loss Prevention - can't get policy to work

Top Replies