Multiple content filtering policies do not create multiple quarantine incidents

Products

• Messaging Gateway

Issue/Introduction

A message matching multiple content filtering policies which take the Create a Quarantine Incident action creates a single quarantine incident for the highest priority content rule and an information incident for each subsequent, lower priority content rules rather than multiple quarantine incidents.

Cause

This is by design.  The idea behind this design is two-fold:

1. A message should only be quarantined once, even if it triggers multiple content filtering policies. Otherwise, it will have to be quarantined the first time due to the first policy, then released, and then quarantined again due to the second policy, and so on.
2. An information incident is created for the subsequent or secondary policies to make sure it is known that those policies were triggered as well.

Resolution

This behavior is by design and cannot be circumvented through policy configuration to create multiple quarantine incidents from a single message.

Additional Information

• Managing how multiple content filtering policies are applied