Data Loss Prevention

Hello,

We are in the process of rolling out DLP for the organisation.

It is important for us that we are able to detect outbound content which includes a certain number of unique e-mail addresses (or more). In such a case, the outbound communication should be stopped. We understand we can create logical rules which are designed to detect the number of occurrences of e-mail addresses within the content (files or mails), but it appears that in the case that an outbound e-mail body contains several occurrences of the same e-mail address (as would be the case of a mail conversation which has built up with many replies) then the rule is triggered and the outbound mail is stopped. Is there a way to ignore multiple occurrences of identical e-mail addresses and match instead against the total number of unique mail addresses?

I checked the forum and found this article which appears to be addressing the same issue but I couldn't see a resolution:

http://www.symantec.com/connect/forums/unique-match-count-email-addresses#comment-8624021

Thanks in advance

The regex in the below link (by Daniel K.) does work.

https://www-secure.symantec.com/connect/forums/dlp-incident-only-one-recipient

However I feel better control with EDMs where you could choose the match criteria to match certain/more than a number of rows etc.

hello

 Uniqueness is only available in data identifier type of rules. So you should be able to create a data identifier for email addresses and then check "Count all unique matches" and set your threshold.

 Regards.

Thank you for your feedback. We will try to implement as suggested.

Best Regards