DLP policy is not working or blocking as expected

Products

• Data Loss Prevention Enforce
• Data Loss Prevention

Issue/Introduction

One or more Data Loss Prevention (DLP) policies are not working properly for detection, number of matches, incident severity, etc.

• Email policy is not working
• HTTP/HTTPS blocking does not work
• Policy not working as expected
• Policy exception not working
• Policy is not working after rebooting
• Prevent policy block response rule not working
• Browser policy not working

Cause

Policy misconfiguration can cause detection issues, show an incorrect severity, or display the correct number of matches.

Resolution

Table of Contents

• Custom data identifiers
• Password policies
• Severity issues
• Other policy issues
• Policy best practices

 

Custom data identifiers

• About upgrading keyword and DI policies
• Custom keyword validators not working for Social Security Number or credit card narrow breadth policy
• DLP Endpoint agent not creating incidents when using a custom data identifier
• All policies stop working after adding regex pattern to a custom data identifier
• Symantec Data Loss Prevention Detection Customization Guide

Password policies

• Create policy to detect Password protected or Encrypted files

Severity issues

• Group Rule applied in a DLP policy is not setting the severity as expected
• Severity of an incident set by number of matches by policy not by rule
• Severity not set correctly for Cloud Email Service incidents
• Incidents no longer generate after Endpoint Servers are upgraded to DLP 15.8
• Severity of Incident is High, but policy is not (broadcom.com)

Other policy issues

• Data Loss Prevention IDM policy not doing partial matches
• DLP Extension Not Working in Google Chrome Incognito Mode
• How the policy rule setting "All recipient must match (Email only)" works in DLP
• Guidelines for tuning Symantec Data Loss Prevention to scan large files

Policy best practices

• High memory or cpu usage of the DLP agent or services when using compound exceptions in policies (broadcom.com)
• DLP Best practices for using Data profiles