DLP - Filter messages if all of the following tags are absent/present?

[gregskigregski]

We enabled DLP on our IronPort appliances and are trying to figure out how to except or not scan for DLP messages with a certain tags in the Header.

All policies have a Filter Message Tags: feature for example The US Social Security Numbers DLP Policy has it but no matter what we do either Filter messages if all of the following tags are absent or Filter messages if all of the following tags are present we can't get it to work right.

I guess I don't understand what they mean by Filter, do they mean only use DLP on those or filter as in do NOT do DLP scans on these messages.  That box is so confusing, please help.

[Andreas Mueller · Accepted solution]

Hello Greg,

the tags DLP are looking after are defined by content filters you create in the outgoing mail policies.

GUI: Mail Policies->Outgoing Content Filter

  Define a condition (if needed) and then use "Add Message Tag" to define a tag that DLP later will use.  Submit that filter, and do not forget to add it to your outbound Mail Policies afterwards.

"Filter messages if all of the following tags are present" means the message will be scanned by DLP if it finds the tags

"Filter messages if all of the following tags are not present" means the exact oposite, all messages without the tags will be DLP scanned, those with the tags will be skipped by DLP.

Hope that helps,

Andreas