No incidents are created when trying to detect keyword in the subject of emails.

RELEVANT VERSIONS:  ALL

By default Symantec DLP enables detection on subject lines (or any other RFC2822 message headers). When the "Match On: Envelope" checkbox in the Conditions section of the Edit Rule page for keyword rules is unchecked, Symantec DLP ignores the header portion of each message.

See also:

KB 42551: What is the definition of an Envelope, Body or Attachment for each protocol?