Which aspect of EPP are you submitting for?
Endpoint Protector Server
What is a one sentence summary of your feature request?
We require a DPI URL whitelist feature that allows us to monitor and track the file types uploaded to whitelisted URLs.
Please describe your idea in detail. What is your problem, why do you feel this idea is the best solution, etc.
The problem we are trying to address is the lack of visibility into file uploads when users access URLs that are explicitly whitelisted in the Deep Packet Inspection (DPI) system. While URL whitelisting is necessary to allow access to trusted websites and business applications, it can also create a visibility gap because users may upload different types of files to these approved URLs without sufficient monitoring or tracking.
The proposed solution is to enhance the DPI system with a file upload monitoring capability for whitelisted URLs. When a URL is added to the DPI whitelist, the system should monitor upload activity associated with that URL and identify the type of file being uploaded, such as PDF, DOCX, XLSX, ZIP, JPG, or other supported file formats.
The solution should provide relevant visibility such as:
Whitelisted URL to which the file was uploaded.
File type and extension.
Upload timestamp.
Source user, device, or IP address, subject to applicable privacy and security policies.
Upload size, where technically available.
Upload activity logs for security auditing and investigation.
This approach would allow organizations to maintain the business benefits of URL whitelisting while improving security visibility and reducing the risk of unauthorized or inappropriate data uploads. It can also help security teams identify unusual upload activity and support incident investigation and compliance requirements.
We believe this is a practical solution because it extends the existing DPI infrastructure rather than requiring a completely separate monitoring platform. It provides a balance between accessibility and security by allowing approved URLs while maintaining visibility into the types of files being uploaded to those destinations.
How do you currently solve the challenges you have by not having this feature?
Currently, we address this challenge using a combination of Zscaler proxy logs. Zscaler provides detailed visibility into the URLs accessed by users and the types of files uploaded to those websites. However, similar visibility is not currently available within the Netwrix Endpoint Protector DPI system for whitelisted URLs. This creates a monitoring gap and requires the security team to rely on external Zscaler logs for tracking and investigating file-upload activities.