Data Loss Prevention

Hello, this my first post. Tks!

I need help in the following case:

I have an environment running DLP 11.6 and some incidents are being duplicated in the Network Monitor.

Can someone please help me with this issue?

Thank you.

Rrosa.

hello

 do you have only one network monitor ? do you have only one policy ?

depending on your architecture it can happens than :

- Each network monitor raise an incident

- One mail matches more than one policy. So you will have as many incident as matching policies.

 regards

Hello,

It is possible that your Network Admin has improperly configured the SPAN/TAP Port. You may need to do a packet capture and send it to support for analysis. We have a traffic analysis tool that detects traffic anamolies.

Best,

Ryan

Hi Rrose,

please chcek whether multiple policy creating incidents on same data/files as there might be duplicate DLP incident are creating diffrent policies as per condition and regular expression.

you need to add anyof 1 policy in excepetion in incident genration rule.

e.g like in credit card match rule  and regular expression for account number may generate duplicate incident for same file as per there match rule.

I agree with Ryan. It is most likey due to incorrect morrioring or TAP configuration.