There is a matching keyword in the body of an e-mail, and an SSN in an attachment, but no incident found.
Relevant to Version 7.0 and up.
When using a Data Identifier, the keyword and the value must be in the same component (i.e., header, body, attachment). An incident will not be created if the matching keyword is in one component and an SSN (for example) in another. For example, in the case of an email, if a matching keyword is in the body of the email, but an SSN is in the attachment, an incident will not be triggered.
For definition of an Envelope, Body and Attachment for each protocol, see TECH218937
Imported Document ID: TECH219177
Subscribing will provide email updates when this Article is updated. Login is required.