CMD & Powershell file transfer block possible for both yes or no
Password protected file transfer block?
AI/ML - Browser and App - how good is the coverage
If a file is already encrypted would the content be blocked
Onedrive in system - file transfer block yes
Language Change for Custom content would not block that anymore?
file transfer between one dept allow but other block - need to create different policies I believe
file tranfer only allow or block for particular domain outside local one - would DPI allowed domains module work here?
Approval file transfer for CAP - OTP / block and remediate will work here
Loopholes to bypass Netwrix DLP - are there any means that are not covered by Netwix DLPs extensive coverage
Lots of questions here, let me address them one by one.
CMD & Powershell file transfer block possible for both
CMD itself is just a shell. It has no network stack or file I/O engine of its own, so to move data out it spawns external executables as child processes. If those child processes are supported and monitored by Content Aware Protection, the transfer can be blocked.
PowerShell is different. Most of its operations run inside its own process (powershell.exe) without spawning a child process, and it’s a supported application under Content Aware Protection.
Password protected file transfer block?
Yes, password protected files (Office, ZIP, RAR, etc.) can be blocked. Keep in mind the content inside can’t be scanned, since Endpoint Protector can’t decrypt it. So the block is based on file type, not content.
AI/ML - Browser and App - how good is the coverage
Coverage here is solid, and we’re adding new services with almost every product update. I won’t list specific tools since the list goes stale fast. The best way to check current coverage is the list of supported applications inside Content Aware Protection.
If a file is already encrypted would the content be blocked
No, we can’t decrypt a file to inspect its content. But encrypted files can still be blocked based on file type.
Onedrive in system - file transfer block
Yes, OneDrive is one of the monitored exfiltration channels.
Language Change for Custom content would not block that anymore?
Custom Content uses pattern matching, so it will only catch the exact content defined under that rule. If the content changes language, it needs to be defined in that language too.
file transfer between one dept allow but other block - need to create different policies I believe
Yes, applying different policies to different departments is definitely possible.
file tranfer only allow or block for particular domain outside local one - would DPI allowed domains module work here?
If by domain you mean an email domain or a URL, yes. Allowlists can be created to permit uploads to specific URLs or email domains/addresses.
Approval file transfer for CAP - OTP / block and remediate will work here
Yes to both. The policy action for Content Aware Protection can be set to Block and Remediate, and an Offline Temporary Password can be used to bypass CAP policies for a limited time when needed.
Loopholes to bypass Netwrix DLP - are there any means that are not covered by Netwix DLPs extensive coverage
No endpoint DLP is airtight. What I can say is Endpoint Protector is a solid, well rounded DLP solution with great exfiltration channel coverage.