How to scan for a specific set of PST classes

book

Article ID: 160551

calendar_today

Updated On:

Products

Data Loss Prevention Endpoint Prevent Data Loss Prevention Endpoint Discover

Issue/Introduction

Is it possible to include or ignore specific .PST content during scanning of a .PST file via Endpoint?

Resolution

A new advanced setting, Discover.IncludePstMessageClasses, is available in version 9.0.1. This setting is a comma-separated list of PST message classes. While scanning PST files, only emails belonging to message classes that are defined in this setting will be scanned. This setting overrides the Discover.IgnorePstMessageClasses setting. For example, when both the settings are defined, Discover.IncludePstMessageClasses takes precedence. Access the Discover.IncludePstMessageClasses setting from the Advanced tab on the Monitor Detail page for each detection server. This setting is only relevant for Discover servers.

PST Message classes are:

 

Message class ID

Message class is used to identify a form for:

IPM.Activity Journal entries
IPM.Appointment Appointments
IPM.Contact Contacts
IPM.DistList Distribution lists
IPM.Document Documents
IPM.OLE.Class The exception item of a recurrence series
IPM Items for which the specified form cannot be found
IPM.Note E-mail messages
IPM.Note.IMC.Notification Reports from the Internet Mail Connect (the Exchange Server gateway to the Internet)
IPM.Note.Rules.Oof.Template.Microsoft Out-of-office templates
IPM.Post Posting notes in a folder
IPM.StickyNote Creating notes
IPM.Recall.Report Message recall reports
IPM.Outlook.Recall Recalling sent messages from recipient Inboxes
IPM.Remote Remote Mail message headers
IPM.Note.Rules.ReplyTemplate.Microsoft Editing rule reply templates
IPM.Report Reporting item status
IPM.Resend Resending a failed message
IPM.Schedule.Meeting.Canceled Meeting cancellations
IPM.Schedule.Meeting.Request Meeting requests
IPM.Schedule.Meeting.Resp.Neg Responses to decline meeting requests
IPM.Schedule.Meeting.Resp.Pos Responses to accept meeting requests
IPM.Schedule.Meeting.Resp.Tent Responses to tentatively accept meeting requests
IPM.Note.Secure Encrypted notes to other people
IPM.Note.Secure.Sign Digitally signed notes to other people
IPM.Task Tasks
IPM.TaskRequest.Accept Responses to accept task requests
IPM.TaskRequest.Decline Responses to desline task requests
IPM.TaskRequest Task requests
IPM.TaskRequest.Update Updates to requested tasks

Microsoft Reference: Item Types and Message Classes