OneDrive/SharePoint protection not working

[RS_Daniel]

Hello community,

We are currently testing Harmony Email & Collaboration (HEC) protection for OneDrive and SharePoint with a new customer and had some problems so we would like to know if anyone has successfully validated this functionality and could share their experience.

According to the administrator guide, Harmony Email & Collaboration scans files in the following scenarios:

• A new file is created

• A file is uploaded

• A file is modified (edited)

• A file or directory is shared with new members

During our testing we are experiencing inconsistent results.

We performed multiple tests by creating, uploading, modifying and sharing files in both OneDrive and SharePoint. Some of these files contained:

• known malicious URLs used for phishing testing

• malware test files used for security validation

In some tests we also used EICAR test files. However, in those cases Microsoft detected and blocked the files before Harmony Email & Collaboration could process them, so they were not useful for validating the HEC detection workflow.

Another observation is related to logging and file visibility in the scanned files list. In several cases it takes 30–40 minutes for files to appear in the scanned files list, and sometimes newly uploaded files do not appear at all. This behavior also occurs in the cases where Microsoft blocks the EICAR files.

Because of this, it sometimes appears that HEC is not detecting or processing all file events in OneDrive and SharePoint.

We would appreciate any insight regarding the following:

1. How long should it normally take for newly uploaded or modified files to appear in the scanned files list?

2. Are there any known reasons why some files might not appear in the scanned files list at all?

3. Are there any recommended methods or best practices for testing HEC protection for OneDrive and SharePoint?

Any help is appeciated.

P.S. Yes, support case already open with TAC 🙂

Thank you in advance.

[the_rock]

Tagging @lluner .

[lluner]

@the_rock 

I have no expertise in this product.

[the_rock]

K, fair enough. I thought of you when I saw this post, so thats why I tagged you.

[PhoneBoy]

@rlopes maybe you have an idea here

[rlopes]

Looks like a HEC topic, not SASE.

[PhoneBoy]

Sorry about that.

[RS_Daniel · Accepted solution]

Just to let you know, apparently it was a problem with the integration between HEC and sharepoint/onedrive. TAC took a little while but RnD team fixed the issue.

Regards