Hi,
You can check for the matched content option in the quarantined emails and see what exactly matched in the policy which is causing the false positives. We can determine what is matching by ensuring that we have the Matched Content Logging enabled under Security Services > RSA Email DLP. Once we have this enabled we can ensure that the quarantine action is set under Mail Policies > DLP Message Actions. This will then allow the messages to be quarantined and we should then see the matched content in the quarantine.
For False Negatives:
Determine which DLP Policy the customer has enabled, and which content the customer thinks should have triggered the policy.
For False Positives:
Find out which DLP Policy was triggered, and get a copy of the email or document that triggered it.
Also, please find below some information on the US State Regulatory Compliance DLP policy named "Washington SB-6043" which might be helpful:
- Washington SB-6043
Identifies documents and transmissions that contain personally identifiable information (PII) regulated by Washington SB-6043. Persons and businesses that conduct business in Washington and own or license unencrypted computerized PII about Washington residents are expected to protect the PII from security breach, and to notify individuals and information owners if their lost PII has been or is likely to be misused. Any person or business that conducts business in Washington and owns or licenses unencrypted computerized PII data for Washington residents, regardless of the entity’s physical location, is required to comply. This policy detects US Social Security numbers, credit card numbers and US drivers license numbers. US drivers licenses are configurable under DLP Policy Manager > Advanced Settings.
I hope the aforementioned information is helpful.
Cheers,
Pratham
