Data Loss Prevention

I have DLP 12.0.  When I look at an SMTP incident, my 4th tab is the Correlations Tab.  In that tab, I see the Sender, Recipient, Subject, Attachments, and Policy.  I'm OK with having all of that information on the tab and printed report, except for the Policy.  The incident count for the Policy is cumulative for the entire enterprise, not just for the guilty sender.  My manager is concerned that this may be misinterpreted by the manager of the offending sender.  

Is there a way that I can customize the Correlations Tab so that it just doesn't show the Policy matches?  I've tried going to Customize Layout, then clicking on Tab 4, which should be the Correlations, but nothing happens there.  I can turn off the Correlations entirely by changing the drop-down for Tab 4, but that doesn't help show the sender's cumulative incident count.  

Does anyone have an idea of if or how this can be done?  

Thanks much...

I don't think there is a way to modify and customize the correlations tab. The fields on the correlation are related to the incident type and all these field are indexed in Oracle DB.

But, I think you can submit an idea about your request to DLP. Maybe this will be treat as a new feature on the next release.

hi,

 dont think you can change that. Be careful that all correlations are cumulative sender, recipient, subject and policies. It is less visible vor recipient and subject but if you have other people sending to same recipient it will be taken into account.

I dont know in v12, but till 11.6.3, correlation is also linked to detection server which catch this incident. So if one people has generated two incident, detected on different detection server (even if it is two monitor servers) wont be counted in correlation.

 regards.

Bangker,

The correlations Tab is not customizable. It is either ON or OFF.

There is no change for this function for V12 or V12.0.1.

If there is a specific functionality that you want you can open a support case and create an enhancment request.

Hope this makes sense.

If this solves your questions please marked as solved.

Ronak