How to scan for a specific set of PST classes

Products

• Data Loss Prevention Endpoint Prevent
• Data Loss Prevention Endpoint Discover

Issue/Introduction

Is it possible to include or ignore specific .PST content during scanning of a .PST file via Endpoint?

Resolution

A new advanced setting, Discover.IncludePstMessageClasses, is available in version 9.0.1. This setting is a comma-separated list of PST message classes. While scanning PST files, only emails belonging to message classes that are defined in this setting will be scanned. This setting overrides the Discover.IgnorePstMessageClasses setting. For example, when both the settings are defined, Discover.IncludePstMessageClasses takes precedence. Access the Discover.IncludePstMessageClasses setting from the Advanced tab on the Monitor Detail page for each detection server. This setting is only relevant for Discover servers.

PST Message classes are:

 

Message class ID	Message class is used to identify a form for:
IPM.Activity	Journal entries
IPM.Appointment	Appointments
IPM.Contact	Contacts
IPM.DistList	Distribution lists
IPM.Document	Documents
IPM.OLE.Class	The exception item of a recurrence series
IPM	Items for which the specified form cannot be found
IPM.Note	E-mail messages
IPM.Note.IMC.Notification	Reports from the Internet Mail Connect (the Exchange Server gateway to the Internet)
IPM.Note.Rules.Oof.Template.Microsoft	Out-of-office templates
IPM.Post	Posting notes in a folder
IPM.StickyNote	Creating notes
IPM.Recall.Report	Message recall reports
IPM.Outlook.Recall	Recalling sent messages from recipient Inboxes
IPM.Remote	Remote Mail message headers
IPM.Note.Rules.ReplyTemplate.Microsoft	Editing rule reply templates
IPM.Report	Reporting item status
IPM.Resend	Resending a failed message
IPM.Schedule.Meeting.Canceled	Meeting cancellations
IPM.Schedule.Meeting.Request	Meeting requests
IPM.Schedule.Meeting.Resp.Neg	Responses to decline meeting requests
IPM.Schedule.Meeting.Resp.Pos	Responses to accept meeting requests
IPM.Schedule.Meeting.Resp.Tent	Responses to tentatively accept meeting requests
IPM.Note.Secure	Encrypted notes to other people
IPM.Note.Secure.Sign	Digitally signed notes to other people
IPM.Task	Tasks
IPM.TaskRequest.Accept	Responses to accept task requests
IPM.TaskRequest.Decline	Responses to desline task requests
IPM.TaskRequest	Task requests
IPM.TaskRequest.Update	Updates to requested tasks

Microsoft Reference: Item Types and Message Classes