Devin AIandFashion Lisa
2bab84f9f9
Phase 2.5: when DLP policy rule has action="block", the collector now actively prevents the action instead of just logging: - USB: Set-Disk -IsReadOnly via Get-Partition/Get-Disk pipeline - Print: Remove-CimInstance Win32_PrintJob for matching jobs - Clipboard: Set-Clipboard -Value $null to clear sensitive content Each enforcement adds enforced=true/false to incident telemetry. Windows balloon notification shown to user on every block action. Backward-compatible: existing action="alert" rules unchanged. Co-Authored-By: Fashion Lisa <igor04091968@gmail.com>
2.9 KiB
2.9 KiB
DLP gap analysis: AWatch-rus vs enterprise DLP class
Текущий контур AWatch-rus
- Endpoint activity tracking (
aw-watcher-afk,aw-watcher-window). - Browser URL/domain collection (native UIAutomation collector).
- Rule-based категоризация web-активности.
- Phase-1 DLP policy: rule match + incident bucket
aw-dlp-incidents_<host>+ локальный incident log. - Автоматизированный deployment (PowerShell, Ansible, Proxmox).
Разрыв до enterprise DLP уровня
- Каналы перехвата: почта, USB/MTP, печать, clipboard, мессенджеры, облака, file transfer.
- Контент-анализ: PII/dictionaries/EDM/IDM, advanced OCR, document fingerprinting.
- Реагирование: block/quarantine/workflow approvals, исключения, эскалации.
- Расследования: case-management, evidence chain, immutable audit.
- Управление: RBAC/SoD, policy lifecycle, multi-tenant admin model.
- Интеграции: SIEM/SOAR/ITSM, AD/IdP, ticketing.
Реалистичный roadmap
Phase 1 (сделано)
- DLP policy JSON + rules.
- Incident generation в отдельный AW bucket.
- Incident cooldown/dedup.
Phase 2 (внедрено частично)
- USB/print/clipboard collectors (endpoint signals) — внедрено.
- Incident pipeline расширен на endpoint события — внедрено.
- File-operation telemetry (create/copy/archive/upload hints) — в backlog.
- Central incident aggregation/export — в backlog.
Phase 2.5 — Enforcement (внедрено)
- USB write-block (
Set-Disk -IsReadOnly) приaction: "block"— внедрено. - Print job cancel (
Remove-CimInstance Win32_PrintJob) приaction: "block"— внедрено. - Clipboard clear (
Set-Clipboard -Value $null) приaction: "block"— внедрено. - Windows balloon notification пользователю при блокировке — внедрено.
- Телеметрия enforcement (
enforced: true/falseв incident heartbeat) — внедрено. - Документация:
docs/dlp-enforcement.md.
Phase 3
- Policy engine service (server-side), versioned policies, approval workflow.
- Correlation engine (user + channel + object + time).
- SIEM connector (CEF/JSON over syslog/HTTP).
Phase 4
- Advanced detectors (dictionary packs, regex packs, OCR pipeline).
- Risk scoring / UEBA.
- Compliance reports (152-ФЗ / PCI DSS / ISO 27001-aligned evidence views).