topic Re: O365 sharepoint-online-downloading not matching while downloading excel files in General Topics

O365 sharepoint-online-downloading not matching while downloading excel files

Sec101 — Sat, 22 Feb 2020 05:11:03 GMT

The application sharepoint-online-downloading will catch word docs. However it does not catch excel file downloads. If we block sharepoint-online-downloading - it will bock everything but excel file and powerpoint downloads. I'm not sure why, but excel files and powerpoint come through as the app sharepoint-online ....Why?

Re: O365 sharepoint-online-downloading not matching while downloading excel files

BPry — Sat, 22 Feb 2020 03:35:26 GMT

Just to verify, you are decrypting all of this traffic correct?

Re: O365 sharepoint-online-downloading not matching while downloading excel files

Sec101 — Sat, 22 Feb 2020 05:10:10 GMT

Yes. Decryption is working normally. I should specify, that this is when you click on File/save as/ "download a copy", and try to download it. Correction - only Word docs get blocked, and marked as sharepoint-online-downloading. Both powerpoint and Excel documents come through, and marked as the application sharepoint-online, not sharepoint-online-downloading. Workaround/solution is to block these files in the app sharepoint-online?

Re: O365 sharepoint-online-downloading not matching while downloading excel files

BPry — Mon, 24 Feb 2020 02:24:05 GMT

@Sec101,

I was able to reproduce this easily enough, so you probably want to open a ticket with TAC so they can get the application team to take a look at things. As a work around, you could assign a file-blocking profile to the rule allowing this traffic and simply deny users from downloading powerpoint or excel files if the application is identified as sharepoint-online.

Re: O365 sharepoint-online-downloading not matching while downloading excel files

Sec101 — Mon, 24 Feb 2020 15:20:13 GMT

How many people know about this? - if this is true - O365 environments are not as secure as once thought right now.