If an incident file is marked as .bad, will it still trigger the block response rule?


Article ID: 159701


Updated On:


Data Loss Prevention Enforce


If an incident file is marked as .bad on the Enforce server, will the response rule still fire, or will the violating message get through without being blocked?


It will be blocked.

If an incident file is generated, then the Prevent server has already generated the incident. Blocking will have occurred if a response rule was set up to block the message. Since the blocking occurs on the Prevent side, whether or not Enforce can read the file is irrelevant.