|
Note: .doc and .xls files are getting blocked as expected.
Configuration:
config dlp filepattern
edit 1
set name "FRAN"
config entries
edit "msoffice"
set filter-type type
set file-type msoffice
next
edit "msofficex"
set filter-type type
set file-type msofficex
next
end
next
end
config dlp profile
edit "DLP-MonitorOnly"
config rule
edit 1
set name "TEST"
set proto http-get http-post ftp
set filter-by sensor
set file-type 1 ---------------> Refers to the DLP file pattern above.
set sensor "Docs"
set action log-only
next
end
next
Performing the scanunit debugs while reproducing the issue shows that the actual content is embedded in document.xml:
diagnose sys scanunit debug all
diagnose sys scanunit debug level verbose
diagnose debug console timestamp enable
diagnose debug enable
su 7858 job 11 DLP: done archive level 1 scan 'word/document.xml' result 0
su 7858 job 11 DLP: start archive level 1 scan 'word/_rels/document.xml.rels'
su 7858 job 11 DLP: scanning file 'word/_rels/document.xml.rels' type 8 len 1351 buffer-type xml decoded 0 archive_is_blocked 0 checking 1 of 1 rules
su 7858 job 11 DLP: Matching rule 0
su 7858 job 11 DLP: file type no match. ------------------------------> File type not matching refers to *docx.
su 7858 job 11 DLP: file_scan no match found.
In order to fix the issue, a new config in the DLP file pattern should be added.
config dlp filepattern
edit 1
set name "FRAN"
config entries
edit "*.xml"
next
end
next
Related article:
Technical Tip: Configure Data Leak/Loss Prevention (DLP)
|
