Hello cristine,

 Reporting in symantec DLP is not always as powerful as we expect for executive or business report on data leakage. What we used to do for our customer is performing an export in csv (for simple report) or xml (for more detailed and complex report) and then process them in excel or other tool. 

 May be it is a stupid point, but you can also remove these messages, which contains only your domain, in DLP policy and so it wont raise any incident.

 Regards.

Hi Steph, 

Thanks for your input. I understand that exporting is always an option for more complex reports - was just wondering if there was any known way within the product

As for removing it fromt he policy, its not an option because the messages/incidents containg recipients from both our own domain and external domains. Deleting it would also remove the count for the external domain. 

Thanks, 

Cristine 

Cristine,

 In DLP policy you can reject message which contains only your domain as recipient and if it contains your domain and some other domains it will still raise an incident in DLP tool.

 It is not the fact to delete existing anomalies but to avoid raising anomalies if messages is sent only to your domain.

 regards.

Hi Calacson,

You can get domain wise filter in All reports and in domain wise reports option in DLP system predifed reports. Also u can get the same by including or excluding and summarizing by domain.

Login to DLP console and see below

go to All reports>network reports>Top recipient (Domains)