URL pattern limit - how to overcome?

[Migration User]

Hello,

I wanted to setup more URL's within the "Recipient Matches Pattern" policy rule, but the field "URL Domain" is limited to just 512 characters. Do you know about any possibility how to overcome this limit? (I do not want tu setup multiple policies.)

Thank you,

Pavel B.

 

[pete]

what is the DLP version?

 

[DLP kishorilal]

Hi Pavel,

You can do this my adding one or more  "Recipient Matches Pattern detection/exception rule within the single policy. Please find the attached snaps.

 

[Migration User]

Hi K S

Your solution forces an AND condition. The policy will trigger an incident if and only if both rules are verified, i.e, a web domain from each rule must be in the recipent field so that the policy triggers an incident.

Pavel, have you tried using the "Email Address/Newsgroup Pattern" field?

 

[Migration User]

It is 11.6.1000.20056 .

Pavel

[Migration User]

Hi Carl,

Thank you for proposal. Not yet. I will try the "Email Address/Newsgroup Pattern" field as soon as a spare time arises. I will let you know.

Rgds.

Pavel

 

[Migration User]

Pavel,

K.S. Sharma was really close with his solution, but as Carl pointed out using the 'Also Match' option at the bottom of the rule creates an 'AND' condition between the rules.

Instead, add your first rule as normal (with as many domains as will fit) and Save it. Then add another rule (to the same policy), add your remaining domains and Save it. By adding each rule individually it creates an OR condition between each.

I would caution you that using that kind of rule is one of the more expensive types in regards to performance so I would double-check your URL list and make sure they are all firm requirements.

Let me know if you have any questions!

Tim

[Migration User]

Hi Carl,

I have tried the "Email Address/Newsgroup Pattern" field for domains' list, but it does not work.
Rgds.

Pavel

[Migration User]

Hi Tim,

Thank you for your proposal. But, as you have said, I am also really afraid about the performance. So, this may be the good solution, but I will try to shorten my domain list first.

Best Regards,

Pavel