If a tag appears on too many documents, it can be reset in ePO through the DLP Policy. Go to Definitions / Tags and Categories and right-click the individual tag. This action resets the unique identifier used. After the policy change is enforced on the client computer, the tag is not applied to any documents until one of the above mechanisms has occurred.
Unless something else is changed in the policy, it is likely that whatever behavior led to the initial tagging can happen again. So, ensure that the users with Manual Tagging capability are aware not to tag documents that are not intended to be protected. Also, any copy from a location specified in a
Location Based Tagging Rule by a user with
read permission to that location results in the destination document being tagged. To ensure that any possible Tagging vector is fine-tuned, double-check the
Application Definitions and the
Discover Scan settings.
The following is an example of how a new or recently reset tag can spread in an environment:
A Location-Based tagging rule is used. An application on a host with DLP Endpoint automatically, without alerting the user, reads a file from the location, such as a desktop.ini file or any configuration file. It then saves a new file with a part of sensitive content into a new share folder. Now, a second user that does not have the rights to the first location can use an application that reads a file from the second share. The tag is propagated when a file with the same content is saved.
To find out in more detail how a new or recently reset tag is multiplying in an environment, use the
Log All Messages option. Use this option on all users that have Manual Tagging rights to read from a share specified in a
Location Based tagging rule, use any applications in an
Application Based Tagging Rule. Or, use the option on all users whose computers are configured for a Discover Scan. This setting is available under
Events and Logging in the Agent Configuration of DLP Policy in ePO.
The following sample log shows how to determine when files are tagged:
NOTE: The logfile name is
HDLP_Agent_(DD.MM.YYYY)(X-XX-XX).log and located under:
c:\Program Data\McAfee\DLP\temp\logs\session##
In the following example, the file named notepadtext.txt is read by Process ID 2644:
18:5:44:388 [2584] [ODEBUG] [File Tracker] [RunningProcessInfo::addFileInfo] Adding the file(notepadtest.txt) to process (2644)
18:5:44:388 [2584] [ODEBUG] [File Tracker] [FileContentAccessedEvent::startProcessEvent] FAcc.FF#000183 start event handler file : \\grepo5\grshare\notepadtest.txt
In the following example, a process with PID 2644 saves a file that is then tagged by the DLP Endpoint:
18:5:44:388 [2584] [ODEBUG] [File Handler] [FileFilterHandler::onOpen] File open for PID(2644) write c:\users\administrator\desktop\notepadtest.txt
...
18:5:44:388 [2584] [ODEBUG] [File Tracker] [ExtendedAttributesService::setFileTags] Setting file c:\users\administrator\desktop\notepadtest.txt extended attributes source tags(1)
The following example shows a direct cut-and-paste action via Process ID 4928:
16:52:23:904 [4728] [ODEBUG] [File Tracker] [RunningProcessInfo::addFileInfo] Adding the file(notepadtest.txt) to process (4928)
16:52:23:904 [4728] [ODEBUG] [File Tracker] [FileContentAccessedEvent::startProcessEvent] FAcc.FF#000582 start event handler file : c:\users\administrator\desktop\notepadtest.txt
...
16:52:23:920 [4728] [ODEBUG] [File Handler] [FileFilterHandler::onOpen] File open for PID(4928) write c:\users\administrator\desktop\notepadtest - copy (2).txt
...
16:52:23:920 [4728] [ODEBUG] [File Handler] [WrittenFiles::insertWrittenFile] WRITE-BUFFER - file - c:\users\administrator\desktop\notepadtest - copy (2).txt PID(4928) pushed first time
...
16:52:23:920 [4728] [ODEBUG] [File Tracker] [FileContentTransmittedEvent::startProcessEvent] FTra.FF#000584 start event handler file : c:\users\administrator\desktop\notepadtest - copy (2).txt
...
16:52:23:920 [4728] [ODEBUG] [File Tracker] [ExtendedAttributesService::setFileTags] Setting file c:\users\administrator\desktop\notepadtest - copy (2).txt extended attributes source tags(1)
The following example shows pasting sensitive content into a document via notepad.exe (PID 2764):
19:43:5:819 [2584] [ODEBUG] [File Handler] [FileFilterHandler::onOpen] File open for PID(2764) write c:\users\administrator\desktop\new text document.txt
19:43:5:819 [2584] [ODEBUG] [File Handler] [WrittenFiles::insertWrittenFile] WRITE-BUFFER - file - c:\users\administrator\desktop\new text document.txt PID(2764) pushed first time
...
19:43:5:819 [2584] [ODEBUG] [File Tracker] [FileContentTransmittedEvent::startProcessEvent] FTra.FF#001193 start event handler file : c:\users\administrator\desktop\new text document.txt
...
19:43:5:819 [2584] [ODEBUG] [File Tracker] [FileContentTransmittedEvent::startProcessEvent] FTra.FF#001193 request text extraction filename(c:\users\administrator\desktop\new text document.txt)
...
19:43:6:115 [2584] [ODEBUG] [File Tracker] [ExtendedAttributesService::setFileTags] Setting file c:\users\administrator\desktop\new text document.txt extended attributes source tags(1)
