Video Screencast Help

Incident Representation Settings

Created: 19 Jul 2013 | 3 comments


Has anyone ever used the Incident Representation settings on the protocol configurations under System > Settings > Protocols > SMTP ?

I want to disable our ability to see traffic on the internal/inbound and I know that creating an exclusion in the policy for our domains or just allowing Uni-Directional flow at the switches would solve the issue but I'd like to handle the exclusion at the L7 side of things. The SYMC definition of how the Uni-Directional setting works is as follows:

Uni-Directional - Evaluate only outgoing traffic.

Has anyone toyed with this feature to make sure it works as intended?

Thank you

Operating Systems:
Discussion Filed Under:

Comments 3 CommentsJump to latest comment

stephane.fichet's picture

Hi tim,

 Yes L7 filters works fine, but take into account that there is a 512 caracters limit in fields length. You can find lot of example on this forum (for example -*

So i worked for international companies where there is lot of internal email domains (depending of subsidiarie name) and so it wasnt possible to select mail traffic to monitor at L7 level.


tim.kerns's picture


I was actually wondering about the setting for Uni-Directional under the Incident Representation settings in the protocol. I've used the L7 filters before and know that they functional correctly but was curious if anyone has ever enabled Uni-Directional traffic through DLP rather than at the switch level.

Thank you for the response though!

stephane.fichet's picture


 sorry, I didnt get your point (i know i must have cupS of coffee before doing anything on monday morning :) ).

I have never use it but you can have a look at

I think it is more about an information on net flow sent to DLP rather than a filtering mechanism, but this is just my feeling and it is not based on my experience.