Skip to content

Endpoint Protector DLP

Endpoint Protector DLP


Discover, monitor, and protect your sensitive data with Endpoint Protector’s advanced multi-OS data loss prevention.

Product Details

Vendor URL: Endpoint Protector DLP

Product Type: DLP

Product Tier: Tier II

Integration Method: Syslog

Integration URL: Endpoint Protector Integration guide

Admin Guide: Endpoint Protector DLP User Guigde

Parser Details

Log Format: Syslog

Expected Normalization Rate: near 90%


UDM Fields (list of all UDM fields leveraged in the Parser):

Log File Field UDM Field
kv.Client_Computer principal.hostname
kv.Client_User principal.user.user_display_name
kv.Content_Policy security_result.rule_set
kv.Destination target.asset.hostname
kv.Destination_Type target.resource_ancestors.resource_subtype
kv.Device target.asset.hostname
kv.Device_PID target.asset.product_object_id
kv.Device_Serial target.asset.hardware.serial_number
kv.Device_Serial target.asset.mac
kv.Device_Type target.asset.category
kv.Device_Type target.asset.type
kv.Device_VID target.resource.product_object_id
kv.EPP_Client_Version metadata.product_version
kv.File_Hash src.file.sha1
kv.File_Name src.file.full_path
kv.File_Size src.file.size
kv.File_Type src.file.file_type
kv.IP_Address principal.ip
kv.Log_ID metadata.product_log_id
kv.MAC_Address principal.mac
kv.Matched_Item principal.user.email_addresses
kv.Serial_Number principal.asset.hardware.serial_number
meta_prod_type metadata.product_event_type
meta_summary metadata.description
obersever observer.hostname
obersever_id observer.user.group_identifiers
observer_ip observer.ip

Product Event Types

Event UDM Event Classification

Log Sample

960 <129>1 2022-12-15T12:12:12-06:00 eppserver 12345 - - EPP IP - - Device Control - File ReaX: [Log ID] abcdec971017bf123da22d8f3e212345 | [Event Name] File Read | [Client Computer] USER-123456 | [IP Address] | [MAC Address] a1-2b-3c-4d-5e-6f | [Serial Number] ABCD123 | [Client User] Jane Doe | [Device Type] USB Storage Device | [Device] Example USB Storage Device | [Device VID] ab1 | [Device PID] cd23 | [Device Serial] 00000000ABCD123 | [EPP Client Version] | [File Name] X:/SampleFolder/SampleFile.pptx | [File Hash]  | [File Type] Microsoft PowerPoint Presentation | [File Size] 1234567 | [Justification]  | [Time Interval]  | [Date/Time(Server)] 2022-12-12 12:12:12 | [Date/Time(Client)] 2022-12-12 12:12:12 | [Date/Time(Server UTC)] 2022-12-15T12:12:12Z | [Date/Time(Client UTC)] 2022-12-15T12:12:12Z

Sample Parsing

metadata.product_log_id = "abcdec971017bf123da22d8f3e212345"
metadata.event_type = "GENERIC_EVENT"
metadata.product_version = ""
metadata.product_event_type = "File Read"
metadata.description = "Device Control"
principal.hostname = "USER-123456"
principal.user.user_display_name = "Jane Doe"
principal.asset.hardware.serial_number = "00000000ABCD123"
principal.asset.ip = ""
principal.asset.mac = "a1:2b:3c:4X:5e:6f"
src.file.size = 1234567
src.file.full_path = "X:/SampleFolder/SampleFile.log"
src.file.file_type = FILE_TYPE_PPTX
target.asset.product_object_id = "cd23"
target.asset.hostname = "Example USB Storage Device"
target.asset.hardware.serial_number = "00000000ABCD123"
target.asset.category = "USB Storage Device"
target.resource.product_object_id = "ab1"
observer.hostname = ""
observer.user.group_identifiers = "12345"
ip: ""

Parser Alerting

This product currently does not have any Parser-based Alerting


Coming Soon