DLP Pop-Up (Endpoint Prevent) sends email even if cancelling or waiting out the timer

I do not need a solution (just sharing information)

Has anyone seen the situation where the DLP Pop-Up functionality is enabled, and even if “Cancel” or waiting out the timer, the follow-on email is distributed?  We have our system configured to pop-up, and if the individual selects one of the programmed radio buttons and then selects “allow”, that an email would be sent to their manager and cc them, which describes the alert situation encountered, date/time details, machine source, etc.  However, if the end user selects “Cancel”, or waits out the countdown timer, which then states the action has been blocked, the email still gets sent to their manager and cc’s them.  This is not ideal or even necessary, as the end user did not send the email.

Any thoughts on how to address this?  Thanks.



Leave a Reply