Is all monitored data stored in the Oracle database and can it be exported?

Products

• Data Loss Prevention Enforce

Issue/Introduction

Does Symantec Data Loss Prevention save all of the monitored data into the Oracle database, including all the http/s and smtp data?

Is there any tool that can be used to analyze the data archived in the Oracle database?

Resolution

Symantec Data Loss Prevention is not designed for data archiving or analysis. Only incidents are stored in the database. If a message does not create an incident, then nothing related to that message is stored.

Once an incident has been created, then the information stored in the database will include HTTPS (Prevent) and SMTP (Monitor or Prevent) data. The confidential data is encrypted by the Enforce server before being stored in the Oracle database. A DBA would be able to export the data but will be unable to read it.