Hello!
We are running DLP 14.6 , Network Monitoring and Endpoint currently.
Due to our mail and span configurations we are seeing all mail outgoing and incoming (and cannot change this.)
Looking to NOT inspect incoming mail, or internal to internal only mail.
In my research I found information on the Protocol Filtering.
"Any email address mask that starts with a minus sign (-) excludes matching messages from inspection. If you add the recipient filter -*@xyz.com, all messages that are sent to anyone in the xyz.com domain are not inspected."
We went to System>Settings>Protocol>SMTP and added to the L7 Recipient
-*@companydomain.com
We then restarted the monitor control for the Enforce server from the Servers Detail screen and tested.
Incoming mail is still being caught by the network monitor.
On the indiviual Network monitors deatils>configure>SMTP>Filtering Content Processing is set to "Use Standard Setting"
What are we missing?
The second concern is excluding the internal only email on the Endpoint side, (we do not have email prevent) we are a Lotus Notes shop and in notes the sender/recipient formating is name/dountry/domain etc...
Thank you in advance for any suggestions or recommendations.