Data Loss Prevention

 View Only
  • 1.  DLP Response Rules

    Posted Jul 04, 2012 12:40 AM

    In DLP admin guide it was mentioned as below

     

    You cannot change the system-defined execution priority for different types of response rule actions. But, you can modify the order of execution for response rule actions of the same type with conflicting instructions.

    Query:

    When we say different types of response rule action, what exactly it mean.

    is it mean response rule action of same server type(Endpoint prevent\Network prevent ) or response rule action of Same execution type like( Automated\Manual)

     



  • 2.  RE: DLP Response Rules

    Posted Jul 05, 2012 07:55 AM

    I believe it means you cannot change the priority certain responses take. For example, a 'send to syslog' may take precedence over 'send email notification'. As in, it will be sent to syslog first if that response is anywhere within the response rule.

    Aaron