Hi,
We have been testing some options and functional aspects of Symantec DLP platform for our company.
When applying User Cancel as Response Rule, would it be possible that when user selects "Cancel", an incident is created but with status "Resolved"?
Because in reality there is an incident, but if the action is cancelled, that should set status as resolved (the issue ends there).
In a company with 35k users that makes a lot of difference when we have to analyse all the incidents...
The ideal solution (as we see it) was to have the hability to define X actions when a user selects "Allow" and to define Y actions if user selects "Cancel". Or, as usual procedure, when user selects cancel, to set status as resolved (as stated before) and send an email alert about it.
Regards.