My customer request me for make a policy that trigger with two conditions when an outbound message:
I have a list of words that I put in Exact Data dictionary.
If there are a message with 1 or 5 of a word inside of the body or attachement, create an incident, send a message and allow message.
If there are a message with 10 or more words inside of the attachement, create an incident, send a message and block the message.
I know how to do both conditions but when the first is trigger the second is not viewed. So, indipendent of the words there are inside of attachement the message pass.
In the SMG the policies are reviewed one by one and in order as they are in position of console. In DLP this isn’t, the console show the policy in alphabetic order.
I put the rules inside of one policy with differents severities but this not work.
Is anybody made a similar policy? How you solved it?