Rule to detect Subject keyword in email body is failing

Products

• Data Loss Prevention Enforce

Issue/Introduction

No incidents are created when trying to detect keyword in the subject of emails.

Resolution

RELEVANT VERSIONS:  ALL

By default Symantec DLP enables detection on subject lines (or any other RFC2822 message headers). When the "Match On: Envelope" checkbox in the Conditions section of the Edit Rule page for keyword rules is unchecked, Symantec DLP ignores the header portion of each message.

See also:

KB 42551: What is the definition of an Envelope, Body or Attachment for each protocol?