Data Protection rules, Keyword Lists & wildcards

I need a solution

Curious as to what the official stance is on wildcards in keyword lists in Data Protection rules.  Inside a keyword list, it clearly states “You can use the asterisk “*” as a wildcard character in a list. The asterisk “*” wildcard can represent any number of characters. “, but when attempting to use a keyword list and something like “*@umin.ac.jp”, the rule fails.  Opening up a ticket with Symantec eventually lead to it’s “not recommended” to use wildcards in keyword lists, even though it clearly states I can.  I feel like I’m getting the run around from support on this because no one wants to acknowledge this is some kind of issue/bug.  Anyone else have any experince with this?

0

Related:

DLP Exceptiom

I need a solution

Hello All,

I have one query/question regarding implementing an exception into DLP policy and below is my scenario which I want to achieve.

Suppose I have 30 different files and each of them have a unique identifier (Keyword or string) from any pdf or word file. I want to add an exception that if each identifier matches with its own file, then DLP should not block that incident, but if even single one missing or not matches with the files attached with an E-mail DLP should block that incident. I hope you would have understood my question/query. 

Attached image might help to better understand the above scenario.

 

0

Related:

Re: Need multiple “Does Not Contain” (-) keyword terms in a single search

I previously posted this in the wrong forum (I will delete my first post).

I have been stumped for a few weeks on this – how to specify more than one keyword to EXCLUDE in a search.


For example, if I want to return emails with the terms ONE or TWO or THREE but only if they don’t include FOUR or FIVE, what would my syntax be?

I have tried:

Keyword: One Two Three (I assume that this is okay) then I add another Keyword field:

Keyword: -Four -Five

Keyword: -Four Five

Keyword: -“Four” -“Five”

Keyword: -(Four Five)

So far, nothing seems to work. I keep seeing emails with FOUR and/or FIVE. I don’t think splitting up terms FOUR and FIVE into separate keyword fields would work since that would create and “AND” criteria.

ALSO – are there any documents that show sample “Complex” searches? The online SourceOne Discovery Manager manual is somewhat straight-forward and simple in their examples.

Thanks in advance for ANY advice.

Related:

Symantec DLP keywords match from a db table

I need a solution

We have a use case where we need to update set of keywords daily for a policy. Instead of updating policy want to have keywords added in a database table and update that table ?

Please share your thoughts and options other than manual updating keywords in a policy.

Thanks

Aadi

0

Related:

Need multiple “Does Not Contain” (-) keyword terms in a single search

I previously posted this in the wrong forum (I will delete my first post).

I have been stumped for a few weeks on this – how to specify more than one keyword to EXCLUDE in a search.


For example, if I want to return emails with the terms ONE or TWO or THREE but only if they don’t include FOUR or FIVE, what would my syntax be?

I have tried:

Keyword: One Two Three (I assume that this is okay) then I add another Keyword field:

Keyword: -Four -Five

Keyword: -Four Five

Keyword: -“Four” -“Five”

Keyword: -(Four Five)

So far, nothing seems to work. I keep seeing emails with FOUR and/or FIVE. I don’t think splitting up terms FOUR and FIVE into separate keyword fields would work since that would create and “AND” criteria.

ALSO – are there any documents that show sample “Complex” searches? The online SourceOne Discovery Manager manual is somewhat straight-forward and simple in their examples.

Thanks in advance for ANY advice.

Related: