Calendar invites are being blocked

Products

• Data Loss Prevention

Issue/Introduction

DLP is blocking calendar invites that are added to emails as attachments. 
The attachment name shows as "Unknown" in the incident.

Calendars (*.cal) have already been excluded in the policy

Environment

Symantec Data Loss Prevention 16.1 MP1 Network Prevent for Email (SMTP)
Standard Outlook calendar invites

Cause

Detection_operational_trace logs on the SMTP Detection server show the calendar attachment was identified as ICS

Attachment  (ID=####)
            - Raw size: ### bytes
            - File name: Unknown
            - File type: ics

Resolution

Two options if you do not want DLP to detect the .ics calendar attachments:

• File Type exception
• File Name exception

File Type Exception:

1. In the policy select the Detection tab
2. Add a "Message Attachment or File Type Match" exception 
3. In the exception, scroll down and select Other Formats > Internet Calendaring and Scheduling (iCalendar) (ICS)
   
4. Test and confirm the policy is working as intended

 

 

File Name Exception:

1. In the policy select the Detection tab
2. Add a "Message Attachment or File Name Match" exception 
3. Add *.ics to the File Name field under Conditions
   
4. Test and confirm the policy is working as intended