Overview

This document explains the Forcepoint DLP remediation script (remediation.bat) that applies classification tags to files identified in DLP incidents. The script is designed to be used as an Endpoint Remediation script with Forcepoint FSM (Forcepoint Security Manager).

Script Architecture

Hybrid Batch/Powershell Design

The script uses a hybrid approach combining batch and Powershell in a single file:

1. Batch Wrapper (Outer Layer)

   • The file has a .bat extension but contains both batch and Powershell code

   • The batch portion executes first and creates a temporary Powershell file

   • This technique allows execution in environments with restrictive Powershell execution policies

2. Powershell Core (Inner Layer)

   • The main functionality is implemented in Powershell

   • Powershell code is contained within the file after the batch section

   • The batch wrapper extracts the entire file content to a temporary PS1 file

How the Hybrid Approach Works

The script uses a clever technique to combine both languages:

This works because:

• In batch, <# :: is treated as a label

• The batch code creates a temporary PS1 file from itself

• It runs Powershell with execution policy bypass

• The Powershell interpreter ignores the batch portion as a comment

• The temporary file is deleted after execution

Integration with Forcepoint FSM

Prerequisites

• GVClient Agent must be installed on target machines with at least version 4.7

• GVClient is properly configured and has connected at least once to the server to download configuration

• Microsoft Office installation is NOT required for this script to function, only metadata is changed

• The script WILL ONLY RUN under SYSTEM context, it will not run when started from under any other user, if started in theterminal this will be presented:

Classification Parameters

When configuring the remediation script in Forcepoint FSM, you must specify a classification parameter that will be passed to the script. The default Getvisibility classification values are:

• "Public"

• "General Business"

• "Confidential"

• "Highly-Confidential"

This parameter determines the classification tag that will be applied to files identified in DLP incidents.

Setup in Forcepoint FSM

1. In the Forcepoint Security Manager, navigate to Policy Management > Resources > Remediation Scripts

2. Select New > Endpoint Script

3. Enter a name and description for the script

4. Upload the remediation.bat file

5. In the Arguments field, enter the desired classification value (e.g., "Confidential")

6. Add the script to an action plan under the Run endpoint remediation script option

7. Add the action plan to a policy in the Severity & Action page

8. Deploy your changes

Open

Example: Setting up a script to apply “General Business” classification

Execution Flow

When a DLP incident is triggered:

1. Forcepoint DLP creates an XML file containing incident details

2. The remediation script is executed with the incident file path as a first parameter andclassification as second

3. The script extracts file paths from the incident XML

4. It uses GVClient CLI to apply classification tags to the identified files

5. Results are logged for auditing purposes

Script Functionality

The script performs the following key functions:

1. Validation

   • Verifies it's running as SYSTEM user (required for Forcepoint DLP remediation)

   • Validates required parameters (incident file path and classification type)

2. Incident Processing

   • Parses the incident XML file to extract file paths

   • Normalizes file paths to ensure proper format

   • Verifies file existence before attempting classification

3. Classification

   • Uses GVClient CLI to apply classification tags to identified files

   • Logs all actions and results for auditing

4. Logging

   • Creates detailed logs in a public location

   • Records execution context, parameters, and results

   • Provides troubleshooting information

Security Considerations

• The script runs with SYSTEM privileges

• It includes validation to prevent unauthorized execution

• Logs are secured with appropriate permissions

• Error handling prevents script failures from impacting system stability

Troubleshooting

• Logs are stored in %PUBLIC%\\Logs\\[incident_filename].log

• The script includes detailed error messages and execution context information

• Common issues include file access permissions and GVClient CLI availability

Sample log entry

Version Information

• Version: 2.6

• Last Updated: 2025-03-15

Download

Open