DLP Enforce - Incident reconciliation - Inconsistent behavior.

Products

• Data Loss Prevention Network Monitor and Prevent for Email
• Data Loss Prevention
• Data Loss Prevention Enforce

Issue/Introduction

Incident reconciliation - inconsistent behavior for MS Purview encrypted emails incidents.

It has been identified that the incident reconciliation feature does not reconcile all the incidents for MS Purview encrypted emails in a particular scenario.

Environment

Release: 15.8, 16.x

Cause

This behavior is observed when a keyword match is detected in the header space of an email by DLP email prevent.

DLP incident reconciliation feature is not able to reconcile all the incidents into a single incident due to the variation in the match positions, which is observed in emails that are encrypted using the MS Purview solution.

Resolution

This issue is still under investigation and a fix is yet to be determined.