Bluetooth RFCOMM file monitoring/blocking in Trellix DLP Endpoint for Windows monitors, blocks, or prompts users for business justification when transmitting classified/sensitive files over Bluetooth connections. It enables security teams to restrict unauthorized data exfiltration without completely disabling Bluetooth devices. The routine workplace operations such as wireless headsets, mice, and other permitted peripherals continue to work uninterrupted. By establishing policy-based controls over RFCOMM communications on endpoints, you can prevent data transfers while preserving everyday productivity.
Benefits
Targeted Blocking: Blocks unauthorized OBEX file transfers while maintaining peripheral connectivity.
Uninterrupted Workflow: Keeps wireless operations running without disabling the Bluetooth connection.
Enable Bluetooth transfer protection
Configure a Removable Storage Protection rule to monitor and block unauthorized Bluetooth file transfers.
Caution
When multiple files are transferred at the same time, Trellix DLP Endpoint evaluates the transmission and may examine or block unclassified files if they are handled together with classified data.
Activate Bluetooth Transfer Protection in Windows Client Configuration
Prior to configuring rules, turn on Bluetooth Transfer Protection within the Windows Client Configuration policy. Activating this option enables the agent to evaluate OBEX and RFCOMM communication channels.
In Trellix ePO, select Menu → Policy → Policy Catalog.
From the Product drop-down list, select Data Loss Prevention, then select Windows Client Configuration.
Select a configuration to edit, or click Duplicate for the Trellix Default configuration.
On the Operational Mode and Modules page, select Bluetooth Transfer Protection.
Click Apply Policy.
Create a Removable Storage Protection rule to enforce file transfer blocking over Bluetooth.
In Trellix ePO, select Menu → Data Protection → DLP Policy Manager → Rule Sets.
Select Actions → New Rule Set, or edit an existing rule set.
Select Actions → New Rule → Removable Storage Protection rule.
Enter a unique name in the Rule Name field and set the State to Enabled.
Under Enforce On, select Trellix DLP Endpoint for Windows.
On the Condition tab, complete these actions:
Select target classifications in the Classification field.
Select Bluetooth Transfer devices in the Removable Media field.
On the Reactions tab, complete these actions:
Set the Action to Block. Supported reactions are, Monitor, Request Justification and Block-outgoing files.
Select a definition in the User Notification field.
Click Save then click Apply Policy.
Result:
Trellix ePO pushes the policy to the managed endpoints. When a user attempts to transfer classified files through Bluetooth OBEX, Trellix DLP Endpoint blocks the transfer and displays the notification. Non-file-transfer Bluetooth channels remain operational.
Terms and Definitions
Term | Definition |
|---|---|
RFCOMM (Radio Frequency Communication) | A transport protocol that emulates RS-232 serial ports over Bluetooth, enabling structured control and data streams between paired devices. |
OBEX (Object Exchange) | A high-level communication protocol designed for transferring binary |
AFAPR (Application File Access | A macOS-specific policy framework within Trellix DLP that regulates |
Data exfiltration | The unauthorized or improper transfer of sensitive, regulated, or proprietary data from an internal system to an external destination. |