Data Loss Prevention

Hello Guys.

Hope you are fine.I have a query about DLP Incidents.I am reciving incidents with file attachment.But i want these incidents without file attachment.So is there any method to remove these files.because due to this the enforce performance is slow.i am waiting your Response.

Hello,

If you mean incidents on DLP console, you can actually select which type of attachments will be captured by each incident, depending on the channel (network vs endpoint).

You can do this creating an automated response rule with retention (then you can select what to retain). Common practise is to retain just the attachment (if any) which generated the incident.

BR,

Morgado

hello

 if you dont need to access email attachment in DLp incident, you can update configuration of your profile to not view attachment in DLP incident (just need to uncheck it as by default it is checked).

 So instead of a link to attcghment file you will have "Not available" tag.

 Regards.

Thank you Symantec Engineers..You have given me best support.i have make a resopnse rule for this incident.so i m not getting any files in incident report