DLP incident resolution via Flexresponse does not resolve for all recipients in SMG quarantine

Products

• Data Loss Prevention Network Prevent for Email
• Messaging Gateway
• Data Loss Prevention

Issue/Introduction

When attempting to remediate an SMTP incident in DLP, not all messages in the Messaging Gateway content quarantine associated with that incident are remediated. Only the first recipient in the DLP incident is acted on in the Messaging Gateway content quarantine.

Environment

Component : DLP FlexResponse, Messaging Gateway

Cause

DLP aggregates multiple, individual messages into a single incident but delivers those messages to Messaging Gateway (SMG) with unique DLP message IDs. When attempting to remediate the incident associated with those messages, DLP only submits the first DLP unique message ID to SMG for remediation rather than all DLP unique message IDs associated with the incident. This results in one message being acted upon in the SMG content quarantine rather than all messages associated with that DLP incident.

Resolution

This is a known issue with DLP Flexresponse and will be addressed in a future release of DLP or the DLP Flexresponse plugin.