search cancel

The policy exception is not excluding relevant incidents


Article ID: 160184


Updated On:


Data Loss Prevention Enforce Data Loss Prevention Network Email


Data Loss Prevention is capturing incidents that should have been excluded.


Relevant versions:  ALL


If you have created a policy exception, but find that you are capturing incidents that should have been excluded, try switching the "Apply Exception to"

radio button from "Matched Components Only" to "Entire Message" under the General section of the Edit Rule page.

This issue occurs when the matched rule is in one component, and the exclude rule is in another component. 

For example, the match is a keyword in the body of an email. The exclusion is in the header.  The matched component will only apply to the body, and not the header.