EMEA Data Loss Prevention User Group

 View Only
  • 1.  URL pattern limit - how to overcome?



  • 2.  RE: URL pattern limit - how to overcome?

    Broadcom Employee
    Posted May 22, 2013 05:29 AM

    what is the DLP version?

     



  • 3.  RE: URL pattern limit - how to overcome?

    Posted May 23, 2013 01:35 AM
      |   view attached

    Hi Pavel,

    You can do this my adding one or more  "Recipient Matches Pattern detection/exception rule within the single policy. Please find the attached snaps.

     



  • 4.  RE: URL pattern limit - how to overcome?

    Broadcom Employee
    Posted May 23, 2013 04:57 AM

    Hi K S

    Your solution forces an AND condition. The policy will trigger an incident if and only if both rules are verified, i.e, a web domain from each rule must be in the recipent field so that the policy triggers an incident.

    Pavel, have you tried using the "Email Address/Newsgroup Pattern" field?

     



  • 5.  RE: URL pattern limit - how to overcome?

    Broadcom Employee
    Posted May 27, 2013 05:14 AM

    It is 11.6.1000.20056 .

    Pavel



  • 6.  RE: URL pattern limit - how to overcome?

    Broadcom Employee
    Posted May 27, 2013 05:16 AM

    Hi Carl,

    Thank you for proposal. Not yet. I will try the "Email Address/Newsgroup Pattern" field as soon as a spare time arises. I will let you know.

    Rgds.

    Pavel

     



  • 7.  RE: URL pattern limit - how to overcome?
    Best Answer

    Broadcom Employee
    Posted Jun 11, 2013 12:11 PM

    Pavel,

    K.S. Sharma was really close with his solution, but as Carl pointed out using the 'Also Match' option at the bottom of the rule creates an 'AND' condition between the rules.

    Instead, add your first rule as normal (with as many domains as will fit) and Save it. Then add another rule (to the same policy), add your remaining domains and Save it. By adding each rule individually it creates an OR condition between each.

    I would caution you that using that kind of rule is one of the more expensive types in regards to performance so I would double-check your URL list and make sure they are all firm requirements.

    Let me know if you have any questions!

    Tim



  • 8.  RE: URL pattern limit - how to overcome?

    Broadcom Employee
    Posted Jun 12, 2013 06:05 AM

    Hi Carl,

    I have tried the "Email Address/Newsgroup Pattern" field for domains' list, but it does not work.
    Rgds.

    Pavel



  • 9.  RE: URL pattern limit - how to overcome?

    Broadcom Employee
    Posted Jun 12, 2013 06:07 AM

    Hi Tim,

    Thank you for your proposal. But, as you have said, I am also really afraid about the performance. So, this may be the good solution, but I will try to shorten my domain list first.

    Best Regards,

    Pavel