Adding prefix in PPS (Personal Public Service) policy not finding the keyword and triggering the incidents

Products

• Data Loss Prevention Cloud Service for Email

Issue/Introduction

In NDLP PPS (Personal Public Service) policy, we are trying to reduce the false positive incidents however when we add a new keyword its generating incidents for all.

Environment

Release : 15.8

Component : Default-Sym

Cause

Create a Data Identifiers (DI)

Defined an example pattern '\d{7}[a-wA-W]' without the quotes

Add the validation checks as 'Exclude Prefix'

Exclude prefix data as 'IE,VAT,TAX, vat,VaT 'etc 

Test the behavior using  'dlptest.com' website on the endpoint environment

Please note that the detection is performed but it not recognized by the Endpoint and it will generate a new incident.

Resolution

A Test Scenario was recreated inhouse and the Data Identifiers behavior we found based on the defined DI, the Endpoint would not differentiate the prefix (VAT or vat or VaT etc) and it will consider the defined keywords as same.

To answer this in simple terms - It's case insensitive.