DLP policy matches report

%3CLINGO-SUB%20id%3D%22lingo-sub-2788039%22%20slang%3D%22en-US%22%3EDLP%20policy%20matches%20report%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2788039%22%20slang%3D%22en-US%22%3E%3CP%3EHello%20Guys%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EWe%20recently%20set%20up%203%20DLP%20policies%20in%20test%20mode%20with%201%20rule%20each%20.%20However%20we%20observed%20as%20below%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E1.%20The%20number%20of%20matches%20changes%20each%20time%20we%20refresh%20the%20report%20.%20Also%20the%20number%20vary%20a%20lot%20%2C%20sometimes%20it%20increases%20by%20200%20and%20sometimes%20decreases%20too.%20What%20could%20be%20the%20cause%20for%20same%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E2.%20The%20report%20shows%20a%20particular%20file%20matching%20multiple%20rules%20in%20the%20report%20.%20As%20per%20my%20understanding%20in%20case%20of%20multiple%20matches%20a%20file%20will%20match%20to%20only%20one%20rule%2Fpolicy%20based%20on%20priority%20set%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E3.%20When%20i%20filter%20DLP%20policy%20matches%20report%20by%20a%20specific%20rule%2F%20policy%20i%20still%20see%20rules%20appearing%20other%20than%20i%20have%20filtered.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EHave%20you%20guys%20also%20observed%20the%20same%20and%20what%20is%20the%20logic%20behind%20the%20same%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-2788039%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3ESecurity%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E
Occasional Visitor

Hello Guys,

 

We recently set up 3 DLP policies in test mode with 1 rule each . However we observed as below

 

1. The number of matches changes each time we refresh the report . Also the number vary a lot , sometimes it increases by 200 and sometimes decreases too. What could be the cause for same

 

2. The report shows a particular file matching multiple rules in the report . As per my understanding in case of multiple matches a file will match to only one rule/policy based on priority set

 

3. When i filter DLP policy matches report by a specific rule/ policy i still see rules appearing other than i have filtered.

 

Have you guys also observed the same and what is the logic behind the same 

0 Replies
We support Ukraine and condemn war. Push Russian government to act against war. Be brave, vocal and show your support to Ukraine. Follow the latest news HERE