Block on Filezilla file transfers fails with Network Communication Protection Rules

Artículos técnicos ID: KB73496
Última modificación: 12/21/2021

Entorno

McAfee Data Loss Prevention (DLP) Endpoint 11.x
Filezilla 3.2.x

For supported environments, see KB68147 - Supported platforms for Data Loss Prevention Endpoint.

Problema

When files are transferred using Filezilla, Network Communication Protection Rules for DLP Endpoint fail to block the file transfer.

Motivo

The Filezilla process is usually defined in the Application Definitions with Editor strategy. But, some versions of Filezilla have a different original file name for the filezilla.exe process and it fails to set the defined strategy for the DLP Agent.

[FileZilla version: 3.2.4]
Name - c:\program files\filezilla ftp client\filezilla.exe
OriginalFileName - filezilla.rc
Product - filezilla
Vendor - filezilla project

[FileZilla version: 3.2.5]
Name - c:\program files\filezilla ftp client\filezilla.exe
OriginalFileName - filezilla.exe
Product - filezilla
Vendor - filezilla project

Solución

Create an Application Template entry for the Filezilla process and set its Process Strategy to Editor:

Log on to the ePO 5.x console.
Click Menu, Data Protection, DLP Policy Manager.
Under the Definitions section, click Application Template.
Click Actions and select New Item. Name the definition Filezilla.
In the drop-down box for Process Strategy, select Editor.
Under Available Properties, click the arrow next to Original Executable File Name to add it to the parameters.
Under Comparison, select Contains and type filezilla in the Value field.
Click Save to save the changes to the template.
Click Rule Sets to define a new rule to apply the new template.
Select an existing rule set to add a rule, or click Actions and select New Rule Set.
Under Data Protection, click Actions, New Rule, Network Communication Protection. For Rule Name, type Filezilla Protection.
Set appropriate values for the required fields, which are identified by a red asterisk (*).
For Application Creating the Connection, in the pull-down box, select Is one of applications (OR), and click the ellipsis (...) next to the text box.
Select the box next to the Filezilla template and choose OK.
Click Save in the bottom-right corner of the screen and save the rule.
Click Save to save the DLP Rule Set, if you are not editing an existing rule set.
Click Menu, Policy Catalog, Data Loss Prevention, and select the policy in the category DLP Policy to which you want to apply the rule. If you used an existing rule set in step 10, select the policy to which that rule set is applied.
Click Apply Policy in the bottom-right corner of the screen.
Perform an Agent wake-up call, or manually update the policy using the McAfee Agent.

Productos implicados

Data Loss Prevention Endpoint 11.6.x
Data Loss Prevention Endpoint 11.5.x (EOL)
Data Loss Prevention Endpoint 11.4.x (EOL)

Idiomas:

Este artículo se encuentra disponible en los siguientes idiomas:

English United States
Spanish Spain
French
Italian
Portuguese Brasileiro

Glosario de términos técnicos

Resaltar los términos del glosario

Tómese un momento para consultar nuestro Glosario de términos técnicos.

Knowledge Center

Block on Filezilla file transfers fails with Network Communication Protection Rules

Entorno

Problema

Motivo

Solución

Productos implicados

Idiomas:

Glosario de términos técnicos

Title

Title

Knowledge Center

Block on Filezilla file transfers fails with Network Communication Protection Rules

Entorno

Problema

Motivo

Solución

Productos implicados

Idiomas:

Glosario de términos técnicos

Elija su región

Title

Title