How to prevent users from downloading specific files from Internet using Harmony

[misj2]

Hi All,

How can I configure the threat emulation policy to  prevent users from downloading specific files via Internet ?

I think its the Threat Emulation advanced options from looking at Admin guide but not sure how and need some help to point me in right direction.   We are still using the on-prem Infinity Portal on server and not migrated to cloud as yet.   

[AkosBakos]

Hi @misj2 

The solution only with Harmony feasible?

If on CP gateway -> the Content Awareness is for this!

Akos

[misj2]

Hi Akos,

We dont have content awareness enabled on gateways.

I think Harmony endpoint can do this just need to know how ?

[AkosBakos]

Hi,

I'm not good at Harmony, so I would wait the experts in this topic.

Why I wrote this tip: this kind of demand arose at on of my customers, and this was the solution for them.

Akos

[misj2]

Hi Akos,

Thanks will await response from Experts to see if there is a solution.   Cheers !

[PhoneBoy]

That's not the function of Threat Emulation, to the best of my knowledge.
Are the files on a specific website? URL Filtering might be useful.

[misj2]

There is a request to block files with .XPS extenstion outright.

[_joel]

Hello, 

You can configure that under : Threat Prevention > Policy Capabilities > Web & Files Protection > Advanced Settings > Download Protection > Override default file actions (download)

Select the File Extension and configure File Action with Block Download (see screenshot)

You can achieve the same using the DLP and configure a new data type with File attribute and maybe using regex if you have a specific file extension. 

[misj2]

I had a look at that but no option to add a new extension to the list , it looks like a predefined list ? Is there can we add to the list ?   

Not had a look at DLP which is on EPMaas  does that need a license ?

[_joel · Accepted solution]

Normally you have two options. Supported files and unsupported files. If you edit unsupported files, you are able to put a custom extension. 

Regarding DLP, yes this is true. Available only on cloud management and not planned on-prem as far as I know. The DLP feature requires an add-on license or its included on the ELITE package. 

[misj2]

Thank you I think I will give that a go !

[misj2]

Sorry last question the Threat Prevention only blocks downloads, how can you prevent access outright of specific files ?

[_joel · Accepted solution]

I've checked and I think the only way to block upload of specific files is by using DLP. Didn't find on threat prevention policy. 

[misj2]

Ok Thanks !