Hi all,
Would you please consider the scenario below and advise on the question that follows:
- DLP admin creates a document profile pointing to remote SMB share, where the business information owners can drop file they would like indexed.
- Day 1 - 2pm - the Information owner dump hundreds of documents in the nominated fileshare (\\servername\Docs_to_be_Indexed)
- Day 1 - 6pm - DLP IDM scheduler runs daily and indexes the content of the SMB share .
- Day 1 - 9pm - AdHoc vbscript deletes the content of the SMB share because the information is very senstive and cannot be left in the location (inadequate security controls)
- Day 2 - 3pm - the Information owner dump a new batch of new documents in the nominated fileshare
- Day 2 - 6pm - DLP IDM scheduler runs and indexes the new content of the SMB share.
Question: On day 2 from 6pm onward, would the document profile still contain hashes for the set of documents indexed on Day 1 ? or would it only contain hashes for the set of documents indexed on Day 2 ?
Cheers,
Cedric.