Thread Info
  • State Not Answered
  • Replies 4 replies
  • Subscribers 11 subscribers
  • Views 1669 views
  • Users 0 members are here
Options
Suggested

Sophos Data Control - Data Loss Prevention Policy

Nicholas Pelczar

We are a SEC shop but making the transition to the Sophos Cloud.  We have used the data control policies in SEC for years to monitor local activity on individual machines.  Unfortunately the same rules and policies on SEC fail to allow Outlook to open in the cloud product.  As a result our migration is on hold.

We can easily duplicate the issue as well as stop the issue by turning off the data protection rules locally.  All Outlook add-ins were disabled to limit variables.

Has anyone seen this issue or currently using the Data control policies?

My support ticket is well over 6 weeks old now and we are doing the same troubleshooting over and over.  



Edit tags
[edited by: GlennSen at 5:44 AM (GMT -7) on 24 Mar 2022]
Parents
  • 0

    Have you narrowed it down to specific rules? 

    If you disable all the rules but leave data control enabled in policy does it work?

    If you run Process Monitor when launching Outlook, do you see any access denied entries that data control could be blocking?

    The other thing might be to enable SSPService trace logging by first disabling Tamper Protection, then setting:

    [HKEY_LOCAL_MACHINE\SOFTWARE\Sophos\EndpointDefense\LocalConfiguration]
    "LogLevel"=dword:00000000

    Restart "Sophos System Protection Service" service.

    Reproduce the issue then check the log \Programdata\Sophos\Endpoint Defense\Logs\SSP.log.

    Filter for all lines (Notepad++ is good for this) that contain [DLP].  Does that help in any way?

    Don't forget to stop the service, remove the LogLevel DWORD and restart the service as the log is pretty verbose!

Reply
  • 0

    Have you narrowed it down to specific rules? 

    If you disable all the rules but leave data control enabled in policy does it work?

    If you run Process Monitor when launching Outlook, do you see any access denied entries that data control could be blocking?

    The other thing might be to enable SSPService trace logging by first disabling Tamper Protection, then setting:

    [HKEY_LOCAL_MACHINE\SOFTWARE\Sophos\EndpointDefense\LocalConfiguration]
    "LogLevel"=dword:00000000

    Restart "Sophos System Protection Service" service.

    Reproduce the issue then check the log \Programdata\Sophos\Endpoint Defense\Logs\SSP.log.

    Filter for all lines (Notepad++ is good for this) that contain [DLP].  Does that help in any way?

    Don't forget to stop the service, remove the LogLevel DWORD and restart the service as the log is pretty verbose!

Children
Unfiltered HTML