EDM Profile Triggers Incident for Numbers with Commas or Full Stops
search cancel

EDM Profile Triggers Incident for Numbers with Commas or Full Stops

book

Article ID: 397141

calendar_today

Updated On:

Products

Data Loss Prevention Network Monitor and Prevent for Email

Issue/Introduction

Customers may notice that their Exact Data Matching (EDM) profile, configured to detect numbers (e.g., "12345678"), triggers an incident when the numbers include commas or full stops, such as "12,345,678" or "12.345.678". This behavior is observed in DLP 16.0 and later versions, whereas earlier versions matched numbers without commas or full stops.

Environment

DLP Release: 16.x

Cause

The system is designed to recognize numbers in common formats, including those with commas or full stops after every 3 digits (e.g., "12,345,678" or "12.345.678"), which are standard for writing large numbers (similar to 12 million, 345 thousand, 678). When the system encounters these formats, it treats them as a single number (e.g., "12345678" without commas or full stops) and checks them against the EDM profile. If the number matches the EDM profile, an incident is triggered. This behavior was introduced in DLP 16.0 to support a wider range of use cases, allowing the system to handle numbers in various standard formats.

Resolution

This behavior is by design, as the system intentionally recognizes numbers with commas or full stops to accommodate common number formats, starting with DLP 16.0. No immediate configuration change is required, as this is expected functionality.

If you prefer that the EDM profile only matches numbers without commas or full stops (e.g., "12345678" but not "12,345,678"), you can consider using EMDI.

Additional Information