1 Reply Latest reply on Aug 10, 2015 8:04 AM by jdenis

    [DLP] How to block an outlook email with TITUS Classification and DLP ?

    jdenis

      Hi everyone !

       

      I am having some troubles using DLP (9.3.1)  on ePO (5.1.0) and TITUS Classification (4.3 SP1)  all together to block emails.
      So here's my issue, I have set up my classification rule and emails' protection rule. So far everything seems to be okay. On Step 8 of 9 of the emails' protection rule I chose these actions :

      • Warn the user the action is prohibited
      • Block the action
      • Save evidences
      • Watch over (not sure about the translation here).

       

      According to this rule, when the email is classified, DLP must pop up a warning to the user and then prevent the email to be sent.


      When I test the rule, I set up my classification on the email and try to send it, I have the pop up that tells me that DLP prevented the email to be sent, so I am guessing it found the Classification and knows the email must be blocked, but few seconds later I receive the email. Meaning even though DLP tells me it blocked the email, in facts it didn't.

       

      Any help here would be greatly appreciated.

      Thank you in advance.

       

      Jo.

        • 1. Re: [DLP] How to block an outlook email with TITUS Classification and DLP ?
          jdenis

          I have investigated a bit further, So ePO version is 5.1, DLP extention version is 9.3.200.23 and the agent version seems to be 4.8.0.887.

           

          When creating an email protection rule on step 7 there's a statement which specifies that agents with a version less than 9.3, the action will be Watching and no blocking will occur.

           

          Given the fact that this step is about the exclusion of emails according to their subject I went through it queekly but now I am worried that all agents less than version 9.3 will have this behavior on all steps of the rule, and that even if it recognizes the TITUS Classification, it won't block the email.

           

          Any suggestions or guess to make on that topic?