How to test policies by using test E-mail files

Products

• Data Loss Prevention Network Monitor
• Data Loss Prevention Enforce

Issue/Introduction

Using Outlook Express you can save.eml files into a drop folder to make sure a policy will generate incidents as expected.

Resolution

• Create an email using Outlook Express.  DO NOT HIT SEND
• Save the email to your desktop; for example, as test.eml
• Copy the test.eml file into the drop folder where the Symantec DLP Monitor is installed, for example c:\drop (make sure you copy and paste! Do not use drag and drop!)
• You will see that the .eml file disappears.  This means that the email was processed by the Monitor

Within the Symantec DLP Enforce UI (Administration -> Overview) you will notice that the processed messages increased by 1.

If an incident was created from the test email, it will have a timestamp from when the email was actually saved. You can sort the incident list by incident ID. Since the test email was one of the latest ones to trigger an incident, it should show up with one of the higher incident ID numbers.