If an incident file is marked as .bad, will it still trigger the block response rule?
Article ID: 159701
Updated On:
Products
Data Loss Prevention Enforce
Issue/Introduction
If an incident file is marked as .bad on the Enforce server, will the response rule still fire, or will the violating message get through without being blocked?
Resolution
It will be blocked.
If an incident file is generated, then the Prevent server has already generated the incident. Blocking will have occurred if a response rule was set up to block the message. Since the blocking occurs on the Prevent side, whether or not Enforce can read the file is irrelevant.
Feedback
Yes
No
Powered by
