Windows 10: What is the location of content that triggers a DLP rule match when using MIP scanner

Hello all,We have been implementing a MIP scanner solution for on premises windows servers in order to find sensitive information that may be residing on plaintext files. After troubleshooting a number of things, the scanner finally started functioning normally. The only question that was raised and I have found no clear answer to, is, where we can find the content of a file that caused the DLP policy match? We are using a custom SIT based on RegEx with a few extra checks, mainly to find passwords and naturally, we need to fine tune the criteria to rule out false positives. In the email t

:)

 

firewall rule to block addresses NOT on an IP list?


I am just starting to learn the Windows Firewall (working on both Windows 7 and 10) and I'm not impressed with the inflexibility of its rules. I would like to know if


1. Is there is a way to do what I want with Windows Firewall?
2. Is there is a third-party firewall that would do it?


What I want to do is create a rule that blocks outgoing connections, for program X, that are to a destination **NOT** in an IP list.


Windows Firewall is not very flexible in how you specify IP list rules. When you give an IP list, your rule will match that list... you can't say "trigger the rule for non-matching IP addresses." Therefore to allow outgoing connections to a list, you have to


1. Change the entire firewall policy to block outgoing connections by default so that you can create an "allow rule" matching your list. This will mess up the rest of your programs.


2. Somehow combine a block rule and allow rule. Create a block rule for most traffic, with the "allow" rule overriding it when appropriate. However, this doesn't appear to be possible in general. It **may** be possible for connections that use IPSec, I'm not sure. And I'm not sure if I can use IPSec in my application.

And is there a third-party firewall that can do it? Most 3rd-party firewalls are LESS sophisticated than Windows Firewall, because the use case they are addressing is providing an interface that doesn't require much comprehension. I need one that's actually MORE sophisticated than Windows Firewall.

 

Microtek scanner on Win 10 Pro

Hi Jean,

To get better clarity on the issue, kindly answer the questions below:

• Is the scanner detected under Devices?
• Were you able to see the scanner on the Device Manager?
• Have you installed the latest driver for the scanner?

We suggest you to run the troubleshooter for hardware and devices. To do this, follow the steps:

• On the Start menu, type Troubleshooting and hit enter.
• Choose Hardware and Sound.
• Select Hardware and Devices and run the troubleshooter.

If issue persists, we suggest you contact the manufacturer to get better assistance.

Do let us know if you need further assistance.

 

WhatsApp desktop input lag when installed along with Trellix DLP

Hi Vincent,

Welcome to Microsoft Community.

I'm Hahn and I'm here to help you with your concern.

It seems like you're experiencing a conflict between WhatsApp Desktop and Trellix DLP that's causing high CPU usage and input lag. The exception you're encountering suggests there might be an issue with memory access or resource allocation that's being exacerbated by the DLP software.



Here are some steps you can take to troubleshoot and potentially resolve the issue:

- Check for Conflicts: Look into Trellix DLP settings to see if there's a way to whitelist WhatsApp.exe or adjust the monitoring settings so that it doesn't interfere with the app's operation.

- Compatibility Mode: Try running WhatsApp desktop in compatibility mode. Right-click on the WhatsApp shortcut, go to Properties, then the Compatibility tab, and try running it in compatibility mode for a different version of Windows.

- Contact WhatsApp Support: Reach out to WhatsApp support as well. They may have encountered similar issues and could provide specific troubleshooting steps or updates related to their app's compatibility with security software like Trellix DLP.

- Debugging: The exception thrown indicates a C++ exception related to memory access. You might want to use debugging tools like Visual Studio to catch the exception and analyze the stack trace. This could provide insights into what's causing the issue when typing.



Since you've already notified Trellix about the issue and identified the exception in the debugging tool, they should be able to investigate further and provide guidance tailored to their software's interaction with WhatsApp desktop.

Your Sincerely

| Microsoft Community Support Specialist