Data Loss Prevention

I have all the standard detections in place (PCI, HIPAA, SNN, etc). I have a Endpoint Prevent response rule that pops up a dialog box asking for confirmation when it sees data being copied/burned, etc. I have a few users that need to copy and paste between apps quite a bit and they get lots of pop ups. Is there a way to only show a pop up every so often but still generate all the events? Basically I just want to reduce the number of pop ups allowed in a time period.

Thanks!

There's an option you can turn on in the configuration that will enable DLP to remember the user answer for that particular policy violation and stop the popup (I'm checking this now so I'll edit this post once I find the exact setting).

Another otion is to create an exception for them in the current policy, then create a second policy for them in particular with no response rule.

A third option is to create a condition in the endpoint notify/user cancel/block response rule that doesn't include those users.

Edit

Apparently, the setting is on by default as I can't find the setting at all (almost sure I saw it some time ago though).

You can tweak the settings in the advanced agent configuration see the excerpt from the help file below. You get to advanced agent config from System -> Agent -> Agent Configuration -> Advanced Agent Settings (tab) -> Edit default configuration

ResponseCache.CD_TIMEOUT.int	2000	The amount of time, in milliseconds, that a CD/DVD incident is cached. Duplicate incidents within this time period are not generated or cause Prevent pop-up notifications.
ResponseCache.FTP_TIMEOUT.int	10000	The amount of time, in milliseconds, that an FTP incident is cached. Duplicate incidents within this time period are not generated or cause Prevent pop-up notifications.
ResponseCache.HTTP_TIMEOUT.int	2000	The amount of time, in milliseconds, that an HTTP/HTTPS incident is cached. Duplicate incidents within this time period are not generated or cause Prevent pop-up notifications.
ResponseCache.MAX_SIZE.int	100	The maximum number of incidents that are cached at any time.