DLP incident resolution via Flexresponse does not resolve for all recipients in SMG quarantine
book
Article ID: 185804
calendar_today
Updated On:
Products
Data Loss Prevention Network Prevent for EmailMessaging GatewayData Loss Prevention
Issue/Introduction
When attempting to remediate an SMTP incident in DLP, not all messages in the Messaging Gateway content quarantine associated with that incident are remediated. Only the first recipient in the DLP incident is acted on in the Messaging Gateway content quarantine.
Environment
Component : DLP FlexResponse, Messaging Gateway
Cause
DLP aggregates multiple, individual messages into a single incident but delivers those messages to Messaging Gateway (SMG) with unique DLP message IDs. When attempting to remediate the incident associated with those messages, DLP only submits the first DLP unique message ID to SMG for remediation rather than all DLP unique message IDs associated with the incident. This results in one message being acted upon in the SMG content quarantine rather than all messages associated with that DLP incident.
Resolution
This is a known issue with DLP Flexresponse and will be addressed in a future release of DLP or the DLP Flexresponse plugin.