7 Replies Latest reply on Jan 13, 2015 6:16 AM by palex

    Duplication Dictionary protection rules in DLP Endpoint


      Good day, help me please!

      1. I have the Dictionary (i am from Russia and originaly name of my dictionary is "Коммерческая тайна"):

      018 The dictionary name is Коммерческая тайна.png

      019 In the dictionary we can see only one word Коммерческая тайна.png

      2. Then i made the Category:

      020 Look at tegs and category - you can see category Коммерческая тайна.png

      and add Classification rule:

      021 the classification rule is active.png


      022 step 1.png

      in my rule i chose the Dictionary (see the first paragraph)

      023 step 2 only one dictionary was selected.png

      024 step 3 to check the entire document.png

      025 step 4 to make the tag Коммерческая тайна.png

      3. I made 2 Protection rules. I show you second rule and describe their differences.

      026 Protection rule is active.png

      I choose email applications

      027 step 1 choosing Email Client Application.png

      I whant to control (monitor) only Libre ore Microsoft Office Applications and besides I choose my Category (see p.2). In another rule i trigged exclude my dictionary.

      Let's clarify once again: in one rule I have included a Dictionary, and the other excluded Dictionary.

      028 choosing office application and category Коммерческая тайна.png

      Step 3 - by default.

      Step 4 - by default.

      Step 5 - by default.

      Step 6 - monitor and  save evidence.


      Step 7 : I don't choose users because I choose users in ePO (see next picture)

      032 step 7 we do not choosing same user but we can choosing user into ePO.png


      033 choosing user into ePO.png

      4. Now I have duplicate evidences.



      You can see 2 rules for 1 file. Whats wrong with my policy?

      Whan i look this evidens, I don't see the word from my Dictionary (see p.1).


      It seems to me that the rule dictionary search not working.

      How can I correct this situation?