Data Loss Prevention

Hi all,

Similar to my previous post of ECM/Endpoint Discover, I am looking for ways to conduct Endpoint Prevent responses on a much larger dataset of approximately 1 million records.

I understand that I cannot use ECM to conduct Endpoint Prevent responses, so I am looking at what the limits of using DCM and a long list of keywords. For example, if the data contains names, I could unique the list of Last Names from the dataset to create a list of keywords. I could then create a policy that only triggers if more than (say 1000) of these keywords appear.

Is there a limit to the number of keywords that can be scanned in this way? Will it ground the endpoint system to a halt for every file transfer?

Thanks,
Nic

The endpoint agent does not handle large sets of keywords very well.  Depending on your policies these keywords will chew through memory and processor available on the machines.  When we were experimenting with things like this lists into the 1000s would cause our memory usage to be as high as 3GB.  However, your environment and policies may be completely different and be able to handle larger lists.  I am doubtful of it handling lists into the millions though.