Given a rule set where MWG will not send anything to a Prevent DLP appliance if it is over a defined size, how is that handled on the MWG side?
For example, if I have a rule that says Body.Size greater than X -> Stop Rule Set (before sending to DLP, how would an archive file that is greater than X, but contains components smaller than X be handled? Would the entire archive be skipped or would MWG send the files in the archive to DLP since they didn't meet the X size limitation?
If the former, is there a way to send the extracted file components to DLP without having them skipped?
MWG (should) only send whole objects to the ICAP server (in the request or response cycle), it does not send components it finds upon opening the object (in the embedded object cycle).