Data Loss Prevention

 View Only
  • 1.  Email Recipient Exception Not Working

    Posted May 28, 2019 01:46 PM

    I followed the instructions at the URL below, but I am not able to exclude emails sent only to users on my internal domain.   This is on 15.5 with an endpoint running the Outlook client (Office 365 ProPlus).  The test emails I sent to myself are detected, although I have the following listed under Policy List > Configure Policy > Detection tab > Exceptions:

    • OVR_EXCEPTION_INTERNAL_EMAIL_RECIPIENT (Protocol): Protocol is Email/SMTP.
    • OVR_EXCEPTION_INTERNAL_EMAIL_RECIPIENT (Recipient): Match COMPANY_RECIPIENT.
      All recipients must match.

     

    COMPANY_RECIPIENT is a Reusable Recipient Pattern with the company domain "company.com" listed under the URL Domains section.

    I only have one policy group and one policy enabled.

    Can you please let me know how to troubleshoot this further?

     

    Thanks,

    Ryan

    https://www.symantec.com/connect/articles/create-dlp-policy-add-exception-ignore-emails-send-internal-users?list_context_id=3667881&list_context_type=symantec_product

     



  • 2.  RE: Email Recipient Exception Not Working

    Posted May 28, 2019 03:03 PM

    if the protocol is smtp why put the exception in the URL section?



  • 3.  RE: Email Recipient Exception Not Working
    Best Answer

    Posted May 28, 2019 03:15 PM

    Hi!,

    The exception should be apply on the Groups Tab > Exception > Recipient Matches Pattern and add the domain in "Email Address/Newsgroup Pattern", please try this.

    --
    Ronald



  • 4.  RE: Email Recipient Exception Not Working
    Best Answer

    Posted May 28, 2019 06:52 PM

    Hi Ronald,

     

    I believe this is working for me now.  I removed the exception from the Detection tab and added it to the Groups tab as you suggested.  I also moved the domain from the "URL Domains" field to the "Email Addresses" field in the Recipient Pattern section of my Reusable Recipient Pattern.

    Thank you for your assistance.

    Thanks,

    Ryan