We are currently testing Websense Data Security to control outbound emails.
The current 7.7.3 version of Data Security displays the following behaviour:
- 1 email is sent to 1 email address and the data contained within it triggers a Data Security rule, then 1 incident is created.
- 1 email is sent to 2+ email addresses with the same domain e.g. gmail.com and the data contained within it triggers a Data Security rule, then 1 incident is created.
- 1 email is sent to 2 email addresses with different domains e.g hotmail.com and gmail.com and the data contained within it triggers a Data Security rule then 2 incidents are created (despite this been a single email).
- 1 email is sent to 10 email addresses with different domains and the data contained within it triggers a Data Security rule then 10 incidents are created (despite this been a single email).
We would like to change this feature to create a single incident when 1 email is sent to numerous email addresses with different domains.
The justification for this is that when 1 email is sent to multiple email addresses, often with different domains, the number of incidents created is very time consuming for our technicians to check and release. 1 email to 10 different domains will require 10 incidents to be checked. Our current outbound email solution (McAfee Ironmail) displays emails as a single incident for both release and reporting purposes.
In addition, the creation of multiple incidents means that Websense Data Forensics are stored for each incident. For example if a 10MB attachment is sent to 10 different email addresses (each a separate domain) then we are storing 10 x 10mb = 100mb of incidents for a single email.
We would either like to request a feature change or any possible workarounds for this issue.
Many thanks