If an incident file is marked as .bad, will it still trigger the block response rule?

book

Article ID: 159701

calendar_today

Updated On:

Products

Data Loss Prevention Enforce

Issue/Introduction

If an incident file is marked as .bad on the Enforce server, will the response rule still fire, or will the violating message get through without being blocked?

Resolution

It will be blocked.

If an incident file is generated, then the Prevent server has already generated the incident. Blocking will have occurred if a response rule was set up to block the message. Since the blocking occurs on the Prevent side, whether or not Enforce can read the file is irrelevant.