Which Spirion Logs Show Anti-Virus Blocks?

Check the following logs:

1. Antivirus (AV)/Endpoint Detection and Response (EDR) Management Console (Primary Source)

This is the most reliable place to see a block. Most modern security tools (CrowdStrike, SentinelOne, Carbon Black, Microsoft Defender) log a "Prevention Event."

• What to look for: Search for events related to the Spirion Service Account or the process spirion.exe.
• Common Block Reasons:
• • "Mass File Access" (often flagged as Ransomware behavior).
  • "Unauthorized Metadata Modification" (when Spirion tries to write NTFS tags).
  • "Suspicious Process Behavior" (due to the agent opening many files in rapid succession).

2. Windows Event Viewer (Local Source)

If you don't have access to the central antivirus console, the local Windows machine often records the block.

• Windows Logs > Security: Look for Event ID 4663 (An attempt was made to access an object). If you see a "Failure" audit for spirion.exe, it confirms the OS blocked the access.
• Windows Logs > Application: Many antivirus tools (like Symantec or McAfee) write their local block events here. Search for the name of your security vendor.
• Applications and Services Logs > Microsoft > Windows > Windows Defender > Operational: If you use Windows Defender, this log explicitly lists any files it blocked Spirion from touching. Look for Event ID 1116 (Malware detected) or 1117 (Action taken).

3. Spirion Agent Logs (The "Symptom" Source)

While Spirion won't say "The antivirus blocked me" (because it doesn't know), the Agent logs show specific symptoms of a block.

Spirion Sensitive Data Platform splits Agent logging across 3 processes:

• SystemSearch / IDF log — Written by the application identityfinderCMD.exe. This is the scan/search log, where file-access failures during a scan appear, for example "Access is denied OS Error Code: 5." This log captures "Access Denied" errors.
• Endpoint Service / EPS log — Written by the application idfEndpoint.exe. Located specifically in: C:\ProgramData\Identity Finder\Logs\EPS
• Shipper / IFS log — Written by the application IDFMessagingSvc.exe (results delivery to Ingress).

How to Get More Detail on the Error

"Access Denied / OS Error Code: 5" is a permissions problem (the Agent's run-as account can't read the Target).

• To capture full detail, raise the log level to 4 (debug) and re-run the scan.
• On Windows the EPS log level is a registry DWORD, as follows:
  HKLM\Software\WOW6432Node\Clients\Identity Finder\Endpoint Service\logLevel = 4

When an Agent registers against an Spirion Sensitive Data Platform console it defaults to log level 1; change it to log level 4 for debugging.

• Location: C:\ProgramData\Identity Finder\Logs\
• • Look for a log such as: Agent_YYYY-MM-DD.log
• Look for "Error 5": This is the generic "Access Denied" code. If you have verified that the Service Account has full NTFS permissions but you still see Error 5, it is almost always an antivirus/EDR block.
• Look for "Process Terminated Unexpectedly": If the log simply stops mid-scan without a "Scan Completed" message, the EDR likely killed the spirion.exe process because it thought it was ransomware.

Example of "Access Denied" Error

Note that the code block below is for illustrative purposes only. Your log may vary from what is shown below.

2024-06-16 14:22:10,452 [14] ERROR - SearchEngine: Failed to open file: \\FileServer01\Finance\Q4_Payroll_Draft.xlsx. System Error: 5. Access is denied.
2024-06-16 14:22:10,453 [14] WARN  - SearchEngine: Skipping file due to insufficient permissions: \\FileServer01\Finance\Q4_Payroll_Draft.xlsx

How to read this error code block

• ERROR/WARN: The severity level. An "Access Denied" is usually logged as an Error when the engine fails to open the file, followed by a Warning that the file is being skipped.
• SearchEngine: The component of the Spirion Agent that was attempting the action.
• System Error: 5: This is the "smoking gun." In Windows, Error 5 always means the OS refused the request.
• Access is denied: The human-readable translation of Error 5.
• Location/Path: The exact file or UNC path that triggered the block.

Variations Based on Action

The error looks slightly different depending on whether the agent was Searching or Remediating:

1. During Classification (Tagging)

If the agent can read the file but cannot write the metadata tag:

2024-06-16 14:25:12,110 [08] ERROR - RemediationManager: Failed to apply classification 'Confidential' to C:\LocalData\Project_X.docx. System Error: 5. Access is denied.

2. During Shredding/Deletion

If the Agent tries to delete a file but doesn't have "Modify" permissions:

2024-06-16 14:28:05,221 [22] ERROR - Shredder: Could not shred file: D:\Archive\Old_SSNs.csv. System Error: 5. Access is denied.

What steps do I take?

give me more details

To provide more technical and operational depth, the Salesforce connector in Spirion SDP is part of the "Anywhere" discovery strategy. It treats Salesforce not just as a website, but as a structured data repository.

Here are the deeper details on how it functions, what it scans, and the technical requirements:

1. Technical Architecture (The CData Layer)

Spirion uses a specialized CData ODBC Driver for Salesforce. This driver acts as a "translator":

• SQL Translation: It allows the Spirion Agent to send standard SQL queries to Salesforce. The driver translates these into Salesforce-native SOQL (Salesforce Object Query Language) or SOSL (Salesforce Object Search Language) calls.
• API Utilization: It primarily communicates via the Salesforce REST and Bulk APIs. For large datasets, it automatically switches to the Bulk API to minimize API limit consumption and improve performance.

2. What Exactly is Scanned?

The connector can look into three primary areas of Salesforce:

• Standard & Custom Objects: It scans fields within objects like Account, Contact, Lead, Case, and any custom objects your organization has created.
• Chatter & Comments: It can scan text within Chatter feeds and object comments where users often inadvertently paste sensitive info (like credit card numbers or passwords).
• Attachments & Files: It can scan files uploaded to the ContentVersion or Attachment objects (e.g., PDFs, Excel sheets, or images attached to a Case).

3. Authentication & Permissions

To set this up, you typically need:

• OAuth 2.0 Flow: You create a "Connected App" in Salesforce, which provides a Client ID and Client Secret. This is the most secure method as it doesn't require storing a raw password.
• Service Account Permissions: The Salesforce user account used for the scan must have:
• • API Enabled permission.
  • View All Data (or specific "Read" access to the objects you want to scan).
  • Access to the Query All Files permission if you intend to scan attachments.

4. Performance & API Governance

Because Salesforce limits the number of API calls a tenant can make per 24 hours, the Spirion connector includes features to protect your Salesforce environment:

• Throttling: You can configure the scan to respect API limits so it doesn't "break" other integrations (like your marketing automation or billing tools).
• Incremental Scanning: After the initial "Full Scan," Spirion can be configured to only scan records that have been modified since the last successful scan, significantly reducing API overhead.

5. Remediation Capabilities

While discovery is the primary use case, remediation in Salesforce is typically handled via Playbooks:

• Notification: Automatically email the record owner if sensitive data is found in a field that shouldn't have it.
• Reporting: Create a "Risk Dashboard" showing which Salesforce Orgs or Objects contain the highest concentration of sensitive data.
• Workflow Integration: Trigger a downstream action (like a ServiceNow ticket) to have a Salesforce Admin move or mask the data.

Common Troubleshooting Tip

If a Salesforce scan fails, the first place to check is the Salesforce Login History.

• If you see "Failed: API Only User," but the account is trying to log in via a browser-based flow, the OAuth configuration is likely incorrect.
• If you see "Success" in Salesforce but "0 Results" in Spirion, check the ODBC DSN settings on the Agent machine to ensure the Security Token (if using password auth) is appended to the password.

How do I add and configure Salesforce as a Target in Spirion Sensitive Data Platform v13.6?

To add and configure Salesforce as a Target in Spirion Sensitive Data Platform (SDP) v13.6, you follow a process that involves setting up the connection in Salesforce, configuring the ODBC driver on a Spirion Agent, and then adding the Target in the SDP console.

Phase 1: Salesforce Configuration (The "Connected App")

Before Spirion can connect, you must create a "Connected App" in Salesforce to provide the necessary OAuth credentials.

1. Log in to Salesforce as an Administrator.
2. Go to Setup > App Manager and click New Connected App.
3. Basic Information: Enter a name (e.g., Spirion_SDP_Connector) and your email.
4. API (Enable OAuth Settings):
5. • Check Enable OAuth Settings.
   • Callback URL: Use http://localhost:33333 (this is a standard placeholder for the CData driver).
   • Selected OAuth Scopes: Add Access and manage your data (api) and Perform requests on your behalf at any time (refresh_token, offline_access).
5. Save the app. Note the Consumer Key (Client ID) and Consumer Secret (Client Secret).

Phase 2: Agent Configuration (The ODBC Driver)

Salesforce is scanned via an ODBC connection. You must configure this on a Windows machine where a Spirion Agent is installed.

1. Install the Driver: Ensure the CData ODBC Driver for Salesforce is installed on the Agent machine.
2. Configure the DSN:
3. • Open ODBC Data Source Administrator (64-bit).
   • Go to the System DSN tab and click Add. Select the CData ODBC Driver for Salesforce.
   • Authentication: Set Auth Scheme to OAuth.
   • OAuth Settings: Enter the OAuth Client ID and OAuth Client Secret from Phase 1.
   • Initiate OAuth: Click Test Connection. A browser window will open asking you to log in to Salesforce and "Allow" access. Once successful, the driver will store the Refresh Token.

Phase 3: SDP Console Configuration

Now that the Agent can "see" Salesforce, you must register it in the SDP console.

1. Log in to the Spirion SDP Console.
2. Navigate to Data Asset Inventory > Targets.
3. Click Add Target and select Database/ODBC (or Salesforce if a dedicated icon is available in your 13.6 build).
4. Target Details:
5. • Name: Give the target a recognizable name (e.g., Salesforce_Production).
   • Agent: Select the specific Agent you configured in Phase 2.
   • Connection String: Use the DSN name you created (e.g., DSN=CData Salesforce Source;).
5. Test Connection: Click the test button to ensure the Console can communicate through the Agent to Salesforce.
6. Save: Once the test passes, click Save.

Phase 4: Scoping the Scan

1. Go to Scans > Policies.
2. Create a new policy or edit an existing one.
3. In the Targets section, select your new Salesforce target.
4. Object Filtering (Optional): You can specify which Salesforce objects to scan (e.g., Account, Contact, Lead) in the target configuration or via a custom query to avoid scanning irrelevant system tables.

SME Troubleshooting Tip

If the connection fails with an "API Limit Exceeded" error, go back to the ODBC DSN settings on the Agent and enable "Use Bulk API". This is highly recommended for Salesforce targets to reduce the number of API calls and prevent the scan from being throttled by Salesforce.

give an example of an “Access Denied” error as it appears in a Spirion IDF log.

In a Spirion IDF (Identity Finder) or Agent log, an "Access Denied" error is typically recorded as a System Error 5. This is the standard Windows error code for ERROR_ACCESS_DENIED.

Here is an example of how this entry would appear in the log file (usually located at C:\ProgramData\Spirion\Logs\Agent_YYYY-MM-DD.log):

Example Log Entry

2024-06-16 14:22:10,452 [14] ERROR - SearchEngine: Failed to open file: \\FileServer01\Finance\Q4_Payroll_Draft.xlsx. System Error: 5. Access is denied.
2024-06-16 14:22:10,453 [14] WARN  - SearchEngine: Skipping file due to insufficient permissions: \\FileServer01\Finance\Q4_Payroll_Draft.xlsx

Breakdown of the Entry

• ERROR / WARN: The severity level. An "Access Denied" is usually logged as an Error when the engine fails to open the file, followed by a Warning that the file is being skipped.
• SearchEngine: The component of the Spirion Agent that was attempting the action.
• System Error: 5: This is the "smoking gun." In Windows, Error 5 always means the OS refused the request.
• Access is denied: The human-readable translation of Error 5.
• Location/Path: The exact file or UNC path that triggered the block.

Variations Based on Action

The error looks slightly different depending on whether the Agent was Searching or Remediating:

1. During Classification (Tagging)

If the Agent can read the file but cannot write the metadata tag:

2024-06-16 14:25:12,110 [08] ERROR - RemediationManager: Failed to apply classification 'Confidential' to C:\LocalData\Project_X.docx. System Error: 5. Access is denied.

2. During Shredding/Deletion

If the Agent tries to delete a file but doesn't have "Modify" permissions:

2024-06-16 14:28:05,221 [22] ERROR - Shredder: Could not shred file: D:\Archive\Old_SSNs.csv. System Error: 5. Access is denied.

Troubleshooting

If you see System Error: 5, the Spirion Agent is telling you: "I asked the Windows Operating System for permission to touch this file, and the OS said No."

The first steps to take once you encounter this message are as follows:

• Determine if the "No" came from NTFS Permissions (the Service Account lacks rights) or Security Software (Windows Defender or an EDR blocked the spirion.exe process).
• Check the permissions on the file/folder for the account Spirion is running as.
• If it's a cloud-backed location like OneDrive, verify the authentication configured inside Spirion for that Target.
• Confirm you can navigate to that path in Windows Explorer from the Agent machine using the same account.

Format caveats worth noting: exact timestamp format, column spacing, and whether the message reads Access is denied vs Access Denied can vary by Agent build.

4. Performance Monitor (Resource Blocks)

Sometimes an antivirus doesn't "block" Spirion, but it "inspects" every file Spirion opens. This causes a massive hit to Agent performance.

• What to look for: If your scan is extremely slow and the System process (or the antivirus process) shows 90%+ CPU usage while spirion.exe is running, the antivirus is "interrogating" the Agent. This is a "soft block" that requires whitelisting.

Summary Table: Log Indicators

Recommendation for Troubleshooting

If you suspect an antivirus block, ask your Security Operations (SecOps) team:

"Can you check the EDR logs for any 'Prevention' or 'Detection' events involving the process spirion.exe or the service account [Your_Service_Account] on [Server_Name] during the time of the scan?"

Summary

Check the EDR/Antivirus Management Console first, then the Windows Event Viewer (Security and Application logs) for "Audit Failures" or vendor-specific block events.

When troubleshooting Spirion Agent interference, you should look for specific Windows Event IDs that indicate either the operating system or a security product (like Windows Defender or an EDR) has blocked the agent's activity.

What Event IDs indicate Antivirus blocks?

Here are the most relevant Event IDs categorized by source:

1. Windows Defender (Antivirus)

If you are using built-in Windows security, these events are found in:

• Path: Applications and Services Logs > Microsoft > Windows > Windows Defender > Operational

2. Windows Security (Audit Failures)

These events show when the operating system denies access based on permissions or security policy.

• Path: Windows Logs > Security
• Note: You must have "Object Access Auditing" enabled in your Group Policy to see these.

3. AppLocker / Windows Defender Application Control (WDAC)

If your organization uses application whitelisting, Spirion may be blocked from running entirely.

• Path: Applications and Services Logs > Microsoft > Windows > AppLocker (or CodeIntegrity)

4. System & Application Logs (General)

• Path: Windows Logs > System or Application

Troubleshooting Workflow

If you suspect a block but aren't sure which ID to look for:

1. Filter by Process: In Event Viewer, use the "Filter Current Log" option and search for spirion.exe in the description.
2. Check the Timestamp: Match the Event ID time exactly to the "Access Denied" error time in the Spirion Agent Log (C:\ProgramData\Identity Finder\Logs\).
3. Look for "Exploit Guard": If you use Microsoft's Attack Surface Reduction (ASR) rules, check the WMI-Activity or Security-Mitigations logs. ASR rules often block "unusual" file activity from scripts or tools like Spirion.
4. See "How to add exclusions"

Summary

Focus on Event ID 1116/1117 for Defender blocks, Event ID 4663 for permission/audit failures, and Event ID 8004 if the Agent won't start at all.