Data Loss Prevention

Is there a way to choose what response the DLP sends based upon the sender’s email address?  i.e. Some offices cannot send a secure email because of the server they are on, is it possible to provide them with one response without specific information and corporate personnel a different notification that does include the specific information?

Unfortunately the only way to do this would to have 2 different policies. Each one would have to be specific to include an AND statement. When you do this you can still use the severity settings based on match count. The AND statement would be based on domain names or they can also be based on AD groups.

SSN + Sender contains domain XYZ (or AD group)

or

SSN + Sender contains domain ABC (or AD Group)

You would then need to have a different response rule for the policy that would then have the right content.

You can also do this by having 2 different rules in the policy. The issue will be that each rule would have to have a different severity setting and you would not be able to use the severity settings based on match count. Then the different response rules for each domain would be based on the severity associated to the rule.