Multiple content filtering policies do not create multiple quarantine incidents
search cancel

Multiple content filtering policies do not create multiple quarantine incidents

book

Article ID: 152646

calendar_today

Updated On:

Products

Messaging Gateway

Issue/Introduction

A message matching multiple content filtering policies which take the Create a Quarantine Incident action creates a single quarantine incident for the highest priority content rule and in information incident for each subsequent, lower priority content rules rather than multiple quarantine incidents.

Cause

This is by design.  The idea behind this design is two-fold:

  1. A message should only be quarantine once, even if it triggers multiple content filtering policies.  Otherwise, it will have to be quarantined the first time due to the first policy, then released, and then quarantine again due to the second policy, and so on.
  2. An information incident is created for the subsequent or secondary policies to make sure it is known that those policies were triggered as well.

Resolution

This behavior is by design and cannot be circumvented through policy configuration to create multiple quarantine incidents from a single message.

Additional Information