The policy exception is not excluding relevant incidents

book

Article ID: 160184

calendar_today

Updated On:

Products

Data Loss Prevention Enforce

Issue/Introduction

Vontu is capturing incidents that should have been excluded.

Resolution

Relevant versions:  ALL

If you have created a policy exception, but find that you are capturing incidents that should have been excluded, try switching the "Apply Exception to" radio button from "Matched Components Only" to "Entire Message" under the General section of the Edit Rule page.

This issue occurs when the matched rule is in one component, and the exclude rule is in another component.  For example, the match is a keyword in the body of an email.  The exclusion is in the header.  The matched component will only apply to the body, and not the header.