Hamony Connect - DLP not working

[chethan_m]

Hi Everyone,

I was testing Harmony Connect's Data Loss Prevention feature, and it doesn't seem to work.

1. I have created the Internet Access Rule as below:

Action	Name	Source	Destination	Content
Block	<name>	<Network & Users>	<email category> & <mail client applications>	<source code, MAC, PCI cards>

2. Set the SSL Inspection to Full Inspection. 

3. Downloaded and imported the certificate to my computer's certificate store (Trusted Root Certificates)

4. Made sure to remove O365 objects from SSL inspection exception.

5. Activated full inspection on any site. 

I'm still able to send MAC addresses, Source Code, Credit Cards numbers via email.

In the traffic logs I can see that HTTPS Inspection action is Inspect not Bypass and yet nothing's happening.

Is there something that I'm missing out? 

Thank you,

[Shay-Mech]

Thank you for bringing this issue to our attention, we will take a closer look at this and will update you as soon as possible

[chethan_m]

Thank you. 

Few more info from logs:

• Action: Redirect
• Inspection Action: Inspect
• File Operation (Data Type Name): Source Code

Result: Email delivered with source code

Any Idea where It's redirected to? According to policy the traffic must be blocked.

[Tamir_Mitnitski]

Hi Chethan,

After discussing with our team, I recommend we elevate this to a Service Request. This way, our TAC team can take a closer look at the use-case and the issue at hand.

As for the redirect action, this action is usually used to redirect users to notify them of a blocked HTTPS site or a certificate warning.

Thanks!

[chethan_m]

Thank you, Tamir. I have opened the SR now. Will update the progress here too.

[EY]

I thought it was a requirement (per sk179817) to install the HTTPS inspection certificate in both Trusted Root Certification Authorities and Third Party Root Certification Authorities.