EMDI policy not detecting data when copying to USB

Products

• Data Loss Prevention Core Package

Issue/Introduction

1. policy with EMDI detection. 
2. copy data to the USB.
3. no detection occurs.

Environment

Symantec DLP 16.x

Cause

in the EMDI the | is used as a separator. In the post processor of the DI the | was missing and the agent would treat that as an exclusion.

Resolution

The test data contains '|' delimiter hence the need to add the '|' in the post-validator field of the DI rule(Custom Randomized SSN (EMDI)).  Refer to the below snapshot

 

Additional Information

If your EMDI delimiters doesnt match what is in the post validators detection may not occur. In this example the EMDI used the "|" character as the delimiter, and so the "|" needed to be added to the post validator box in the Data Identifier that was being used.