White List issue faced in DLP

[Vishnu Achuthan]

Hello

My objective is to block confidential documents sent via mail outside the network, as per business req I had to white list a particular destination e.g example.com. The problem I faced was on whitelisting the said URL, the Recipients having that particular whitlelisted URL as one of its several destinations gets totally ignored by DLP . No incident was generated.  For example:
 

White listed: [e-mail]

Sender: [e-mail]

Recipient: [e-mail] , [e-mail] , [e-mail]

A simple PCI rule would trigger an event if Confidential Documents was being sent to above Recipient and should block it via response rule. Since [e-mail] is under white list, no events were generated. DLP ignored the other destinations such gmail, yahoo etc in Recipient. As a result we have no visibility over data moving to other destinations .

Please suggest some ways to tackle this issue.

 

Regards,

Vishnu

[ShadowLeaf]

Hi Vishnu,

Duble check the exclusion rule to ensure that you have selected the radio button that says 'All Recipients Must Match - SMTP Only'.

 

If this has not been done, make the change and test again.

 

This means that for the above scenario an incident would trigger if an email was sent to : Recipient: [e-mail] , [e-mail] , [e-mail]

 

Please verify and send screenshot if possible.

 

Thanks!

SL