Can you use DLP to block a custom file type?

[fionaC]

Hi All, 

I have been trying to get DLP to block a custom file type which is *.kdb      so by custom, I mean a file type not included in the default file filter list. 

I have tried two different ways - by creating a filepattern using "config dlp filepattern  and attaching that to a DLP profile, and attaching that to my policy. Did not work.

So I then created a dictionary with regex value for the file type, set pattern "\\.pmb$", and attached it to a sensor, profile, policy.

None of these seem to work and the DLP is never triggered.

Any ideas? Thanks.

[Anthony_E]

Hello,

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.

Thanks,

[kmohan]

Hi Fionac

You can follow the below kb articles:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Use-case-to-block-a-file-type-using-DLP-pa...

https://community.fortinet.com/t5/FortiGate/Technical-Tip-DLP-Configuration-to-Block-by-file-type-an...

[fionaC]

Thank you. The second KB does not seem to work for custom types. I tried similar to the first KB, and it is not working. I have opened a support case. Thank you for your kind reply.  You time is appreciated.