Data Loss Prevention

Hello,

My DLP 14 (endpoint prevent license) can't differentiate the difference between the match on Body vs match on Subject for emails. I would like to create a compound that allows me to say to create an incident if the keyword X is found in Subject AND if the keyword Z is found in the body of the email.

Currently the incident is generated no matter where both keywords are found; in body OR subject.

Is this happening to someone else?

Thanks.

Hello Morgado,

Can't you use this ?

Hello Thomas,

I wish I could.. but it doesn’t work with the endpoint prevent. DLP can’t differentiate if the keyword is in body or email. Both keywords in body will generate an incident as well.

Already submitted a case to Symantec.

I got the confirmation that DLP is not capable of differentiate it on endpoint channel, just network. Closing this topic.