Apparent duplicate incidents from Gmail when using Web Prevent or HTTPS monitoring with Endpoint Prevent

Products

• Data Loss Prevention Endpoint Prevent
• Data Loss Prevention Network Prevent for Web

Issue/Introduction

While composing an email using Gmail in a web browser, Gmail draft autosave will generate an incident every 15 seconds if the message being composed contains data that would trigger a policy. There is no way to turn off Gmail autosave, thus, a DLP-centric solution is required.

Cause

DLP operates based on content sent to the web via HTTP PUTS or POSTS. Gmail is designed to save draft emails automatically and this save functionality will get picked up by DLP if violating content is present. 

Resolution

The draft emails get sent to taskassist-pa.clients6.google.com, you may consider whitelisting this address in the agent pre-filters. 
This will run the risk of allowing users to write draft emails within Gmail without clicking 'send' to go undetected by DLP.

Additional Information

Filter by Network Properties settings