Extended content inspection
FortiDLP's Unauthorized email sent or received template provides two sets of content inspection parameters, allowing you to search for different patterns, keywords, and MIP labels in different sections of an email.
Both sets comprise all of the content inspection parameters previously mentioned, as well as the Content inspection location parameter, which defines the email sections for inspection.
Neither set of content inspection parameters takes precedence over the other. When configured, the two sets are combined to give you more control over when detections are raised.
|
For example, you could create a policy that raises a detection when a credit card number is found in the email body and attachments, and the keyword "Finance" is not found in the subject line, as follows. Configuration 1:
Configuration 2:
|
|
For the Unauthorized email sent or received template, all configured parameters must be met to generate a detection or block an email. Additionally, to perform content inspection, at least one location and pattern, keyword, or MIP label is required. Specifically, when MIP labels are selected, ensure you set the Content inspection location parameter to Email attachments and/or Email headers based on where matching should occur. |