Data Loss Prevention

I'm using Sym DLP v11.1.  Is there a way to order the execution of policies for email and web prevent?

are you using both?

when the user sends email it checks with the MTA for policy and then take nexessary action, similalry for http/ftp the web prevent server of DLp will take the action.

I have a 3 tier implementation using both types of detection servers in forwarding mode. I'm hoping the order of policy execution can be controlled by the a config file on the enforce server rather than individual detection servers

Hi jeff

 I didnt understand your point as mail and web prevent didnt apply on same type of message (one for mail and one for http/frp request). Why do you want to order them ? each server (web and mail prevent) will apply policy to message received.

 you can deploy policies on a specific server using different policy group (one for mail prevent and one for web prevent), but you cant define the way or any priority betwwen each policy.

 regards

Let me rephrase the question.  Can I control the order in which email prevent policies are executed when an email message is inspected?

no jeff, you cant. And your email will be analyzed by all policies, you cannot stop execution of policies if one policy has matched.

If it matters, the intent is not to stop any policy just control the order in which they execute.

it will be checking for all policies applied for the server.

I think it is based on creation of policies in policy list. But execution of rules are like exclude first then scan to include.

Jeff,

If I remember some detailed debug logs, it may be that the work is done in order of creation of the policies.  I seem to recall the policy numbers were increasing in the log.

I do know that exceptions are processed first and then rules.  Both types are evaluated in order of increasing "cost".

I also reall that a particular rule is only evaluated once and the results used by any other policy that has that rule.

JGT

Thanks JGT,

the reason i ask is because it appears if an email violates multiple policies, and the response rules on those policies conflict with each other, the response rule does not work as expected.  Specifically if response rule from policy A saves attachements/original message then the response rule from policy B to limit incident data does not discard attachments/original message.