Exception on Download File Type Prevention

[sifislaz]

Hello Mates,

A customer has Harmony Endpoint (and Harmony Browse) and posed the following requirements for its infrastructure:

• Users cannot download archive file types
• Except downloading .zip, .rar, .7z from specific domains

The first requirement is achieved from: Policy -> Threat Prevention -> Policy Capabilities -> Web & Files Protection -> Advanced Settings -> Download Protection -> Override Default Files Actions.

When I tried to create an exception for the specific functionality, I hit a dead end.

Any ideas on how to achieve that?

[PhoneBoy]

Endpoint, which client version, managed on-prem or with Infinity Portal?
Where exactly did you try to add the exception?

[sifislaz]

Client version E88.72, managed on Infinity Portal.

Exception methodology:

1. I reviewed the logs and spotted Threat Extraction blade as the “active” blade during download blocking.

2. I went to Global Exclusions center and tried to create a Single method exception with the Domain that they wanted to be excluded, for Threat Extraction blade.

3. I have noticed that Threat Extraction blade is not included on the available blades for exceptions, so I tried Threat Emulation, without success.

[PhoneBoy]

Not sure it's Threat Extraction (or Threat Emulation) that's doing the blocking in this case, I would try Anti-Virus.
Tagging @AdiGH 

[the_rock]

Might be worth trying E89.10

[jcortez]

Hi @sifislaz 

For issues like this, it is best to open a Case/SR with our Technical Support so our Endpoint Team can get logs from you and the Forensics Report to understand why the exclusions are not working. The issue may look simple from the top level, but it could be a slightly more complicated issue that is not clear enough.