This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

DLP violation

Emails keep getting quartered in under DLP violation, however the file is not in the policy! Support haven't come back to me in weeks and seem to ignore my emails.

Any ideas ?

Policy:

Base Policy

Rule:

Attachment file types (Inbound)

Category:

Attachment file types

smime.p7s:
- Certificates

Added tags
[edited by: Raphael Alganes at 7:34 AM (GMT -7) on 24 May 2023]

Parents

0 LuCar Toni over 4 years ago

Could be related to the DLP Policy (Sophos recommended files)? Because this Policy will actually hit on S/MIME Signed Emails.

As you know, a S/MIME Email will have a certificate attached to it.

__________________________________________________________________________________________________________________
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 LuCar Toni over 4 years ago

Could be related to the DLP Policy (Sophos recommended files)? Because this Policy will actually hit on S/MIME Signed Emails.

As you know, a S/MIME Email will have a certificate attached to it.

__________________________________________________________________________________________________________________
Cancel
Vote Up 0 Vote Down

Cancel

Children

0 Stephen Stern over 4 years ago in reply to LuCar Toni

Yes, turns out the Sophos knows about the issue with default policy including the extension, but their document/KB which states which extensions it blocks doesn't state it as one of them.

Using a custom policy list and unticking certificates category may have resolved it.
Cancel
Vote Up 0 Vote Down

Cancel