This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

PC´s cant register XLS with policy of code postal.

Hi ,

my pc can´t register when attach xls from webmail outlook.

 

I have hable the role but the pc dont register event.

For example , i send one xls with this information.

My config of role is:

register all document with more 10 postal code.

Codigo Postal

02344

02344

02344

02344

02344

....

Can you help me please ?

Thanks.

<?xml version="1.0" encoding="utf-16"?><rules xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns="http://www.sophos.com/xml/msys/datacontrol.xsd"><contentRule action="alertOnly" ruleRevisionId="1812384e-e7ce-44b8-8547-7c4e60a9ab18" name="06 - Lista de direcciones postales - Global - Bloqueo total" comment="Identificar archivos que contengan cien o más direcciones postales."><destination><device type="removableStorage" /><device type="floppyDrive" /><device type="opticalDrive" /><uploadApp value="Microsoft Lync" /><uploadApp value="Office Communicator" /><uploadApp value="WebEx Connect" /><uploadApp value="Firefox (V7 and higher)" /><uploadApp value="Firefox 1" /><uploadApp value="Firefox 2" /><uploadApp value="Firefox 3" /><uploadApp value="Firefox 4" /><uploadApp value="Firefox 5" /><uploadApp value="Firefox 6" /><uploadApp value="Google Chrome" /><uploadApp value="Internet Explorer 10" /><uploadApp value="Internet Explorer 11" /><uploadApp value="Internet Explorer 5" /><uploadApp value="Internet Explorer 6" /><uploadApp value="Internet Explorer 7" /><uploadApp value="Internet Explorer 8" /><uploadApp value="Internet Explorer 9" /><uploadApp value="Adobe Flash file uploader" /><uploadApp value="Firefox Plugin Container" /><uploadApp value="Lotus Notes Client" /><uploadApp value="Outlook" /><uploadApp value="Outlook Express" /><uploadApp value="Windows Mail" /><uploadApp value="Skype" /></destination><contentReferenceSet /><predefinedContentReferenceSet><content name="PostaladdressesSpain" quantity="10" /></predefinedContentReferenceSet></contentRule><contentConditions /></rules>



This thread was automatically locked due to age.
Parents
  • Hello cristianodias,

    I assume you also don't get an alert when, for example, you copy to a USB stick.

    You could turn on verbose logging on the endpoint - this would show if there's at least some partial match. I doubt though that you will get any useful output. You have selected Postal addresses (Spain) and while the description says Addresses where the first line of the address or post code are provided (emphasis mine) I don't think it will trigger on just a set of 5-digit numbers (as the rule should apply to all kinds of documents alike the column heading Codigo Postal has likely no significance).
    As a test please create an XLS with ten or more (complete) addresses and check whether this triggers an alert.

    Christian

  • Hi , this test i to try to webmail office365.

    I test with complete addresses but dont register.

    I undestarnd the complente address is for example:

    Pepito vila, 22 "Edifici Star" Planta 1ª

    08171 - Sant Cugat del Vallès (Barcelona)

    I would like undestarnd the format of file to detect a rule.

    For example , i to try one rule numbers of accounts Banks , then this case with format of document are detect ?

    i to try créate one document with more the register of  International Bank Account Number (IBAN) but dont register.

    Have any information of sophos to explain how to use the rules and your format ?

    Thanks so much ,

     

     

  • Hello cristianodias,

    I've never used DLP in production and it's years since the last tests.
    Tried your example without success. It did work with something like
    Organismo Autónomio Correos y Telégraphos
       Area de Asuntos Internacionales
       Calle Aduana, 29                     
       28070 MADRID
    in a plain txt file, but it failed with a PDF. Though simple rules (like Confidential documents) did work with the PDF as well - this suggests it's not completely dysfunctional. I remember that I did test IBANs and CCNs with different file formats (PDF, XLS, ...), DLP might have been be picky on the format though (i.e. whether it's all one string or a number of blocks).

    The DLP forum isn't actually read-only it seems but it looks orphaned. As DLP has been added to Central though it seems it isn't dead. AFAIK there isn't any detailed documentation on the predefined CCLs and what exactly they (are able to) detect. So unfortunately I can only suggest that you try to contact Sophos through the partner/reseller or perhaps directly. 

    Christian

               

  • Hi Christian ,

     

    thanks again. I to test with your example and work ok. :)

    But , how you know it Works with this format ? :) I would like know too for the another rulers.

     

    @ IBAM for you are ready ok ?

     

    Thanks.

  • Hello cristianodias,

    I assume the "complex" rules expect a more or less official/standardized format.

    IBANs (at least for the supported countries) are correctly detected (with or without embedded blanks) in txt, xls(x), ods and pdf (these I have tested). 

    Christian

  • Hi  Christian ,

    thanks.

    the finaly question.

    what the best practice for apply the rules ??

    witch is more better :

    One rule of  content with all types. For example:

    rule content1

    IBAM , EMAIL , POSTAL CODE , etc.

    Or is more better to créate one rule by types:

    rule ibam

    rule email

    Thanks.

  • Hello cristianodias,

    there's no best practice - you have to create them correctly: You might not yet have noticed but it's Rule 1 OR Rule 2, and within a rule CCL1 AND CCL2.

    Christian

  • Hi Christian ,

    Look this example:

    I have the Rule 1 and within this rule i have

    CCL1 - IBAM 

    CCL2 - Postal Code

    The rule 1 only active if my document content information IBAM and Posta Code ??  The AND is one logical operation ? :)

    Thanks son much ,

     

     

     

  • Hello cristianodias,

    correct, both CCLs must match for the rule to trigger, and yes, it's a logical AND. Please note that rules might have different destinations and/or actions (allow/acceptance/block) - IIRC the most restrictive wins.

    Christian

Reply
  • Hello cristianodias,

    correct, both CCLs must match for the rule to trigger, and yes, it's a logical AND. Please note that rules might have different destinations and/or actions (allow/acceptance/block) - IIRC the most restrictive wins.

    Christian

Children