Hi All,
I have created an endpoint policy to prevent user from sending email if matching keyword found only in an attachment not in body of email. But the problem is policy is working fine but pop up comes when matching word found in body of email which i dont want. I only want pop up to comes if matching keyword detect in attachment only.. right now it is showing pop for both body and attachment keyword is detecting fine but why it is detecting in body mail this is the problem.
following are the details i have configured:
add policy> content match >> keyword "confidential">>on whole words>>match on "Only attachment" is selected rest other options "Envelope", Subject, Body are unchecked as i only want detection in attachment.
along with AND condition below
protocol and endpoint monitoring >> email /SMTP is selected only.
Response rule - > prevent user pop up block options with multiple options
Now this policy works like this confidential word matching in body or attachment it shows pop up but i have only selected attachment in keyword match option then why it is picking from body mail.. i only want detection in attachment not in body.
Please suggest whats wrong with this..