Video Screencast Help
Symantec to Separate Into Two Focused, Industry-Leading Technology Companies. Learn more.

Add Header to every email that DLP Touches

Created: 03 Dec 2012 • Updated: 20 Dec 2012 | 3 comments
This issue has been solved. See solution.

This is just for testing purposes and I will remove the header once our testing is complete as we need to see how long it is taking our test emails to move through our system.

I would like to know is there a way to add a header to every email that goes through DLP to just say that DLP touched it and at what time.

Comments 3 CommentsJump to latest comment

stephane.fichet's picture

Hi mike,

 I think you want to perform your test using a network prevent server.

You can add a header to your email adding a response rule in your policy and choose action "Modify SMTP message". So if you want to do it only for test email, you can dedicate a policy to this using a keyword than no one else will ever use and so from time to time you are able to check if system is working or not (it is the best way to control DLP is working well as sometimes services are up but DLP is down).

 Adding time will be quite difficult as i am not sure you can add a variable in header value. If you cant add it in header (or subject as you can also modify email subject) you can check in xml export of your test incident and you will have some detailed time value (send date, detection date, incident creation date).

 But if you want to check if DLP will add a latency in messaging system, you also need to have time information from your current system without DLP.

Feel free to contact me via MP or email as i am always interested in this type of control/performance check of DLP system. 

Regards.

yang_zhang's picture

Yes.

Defaultly, every email that pass through the DLP Network Prevent for Email server will be added a x-header that named X-CFilter-Loop, and the default value of this x-header is Reflected.

You can find out this on the server's advanced settings:

And, here is an example of the x-header of the email that pass through the DLP:

If a forum post solves your problem, please flag it as a solution. If you like an article, blog post or download vote it up.
SOLUTION
Mike S.'s picture

that is perfect. I will leave it at that then. thanks