Tracking a DeviceID for use in a Symantec DLP Policy

 

Overview

Symantec Endpoint Prevent for DLP has the ability to track and limit data being copied to removable storage (USB drives, etc.).  Within a DLP policy we can leverage the DeviceID of a removable storage device as either an inclusion or exclusion to our policy. This document will cover how to set it up.

Process

The first tool we need to leverage is “DeviceID.exe” which is a part of the Tools folder under the DLP agent source directory.  This executable will allow us to gather both the Device ID and the Regex that is needed for either the exclusion or inclusion.

This information is taken from the Help file for DLP and the DLP Admin Guide.

1. Connect the USB Device to your computer
2. From the command prompt navigate to the folder where the “Tools” directory is located
3. Execute “DeviceID.exe” to get a list of the devices attached to your computer
4. There are two values displayed per device connected to your laptop/desktop
   1. Dev ID: Contains the full string for the device connected to your laptop
   2. Regex: The value we want to put in our exclusion or inclusion
   3. NOTE: If you have a large amount of devices attached to your laptop or desktop the output can be directed to a text file via “DeviceID.exe > textfile.txt”
5. Open up the DLP Console and navigate to System -> Agents -> Endpoint Devices
6. Select “Add Device” and fill out the form
   1. Note: Use the Regex value from DeviceID to fill out the device definition portion of things
   2. NOTE: The goal is to be both as generic and specific as possible to make sure there is not a giant list of device ids

Leveraging the DeviceID in a DLP Policy

Once the DeviceID is created it can be used as either an exclusion or an inclusion within the policy

1. Login to the DLP Console
2. Navigate to Policy Portion (Policy -> Policy List)
3. Edit (or create) the policy you would like to use this in
4. Select “Add Exception”
   1. Towards the bottom of the Exception Type is “Endpoint Device Class or ID”
      1. Select this option and select “Next”
      2. 
      3. Select the DeviceID you would like to use for an exclusion and select next
      4. 
      5. Select “OK” to save your exception
5. NOTE: This same process can be used to create an inclusion in your DLP Policy as well