Policy Guide › Whose Policy Is Applied? › Email Activity

Email Activity

CA DLP associates emails with users depending on how and where CA DLP detected the email (the ‘capture source’).

• Email endpoint agents: When CA DLP detects emails in Outlook or Notes, it associates the user’s Windows logon credentials with a matching CA DLP user account and applies that user’s policy. That is, CA DLP can identify the user sending (or receiving) an email and apply that user’s policy to the email.

  The synchronization between Windows accounts and CA DLP accounts is created in the CMS database during an Account Import job or, less commonly, by using Microsoft Windows user authentication to automatically generate new user accounts.

• Email server agents: For emails detected as they pass through Exchange, Domino or Sendmail servers, CA DLP first determines whether the sender’s email address matches an internal address pattern. If it does and the sender corresponds to an existing CA DLP user account, that user’s policy gets applied.

  If no matching CA DLP user can be found, or if the sender is deemed to be external, then CA DLP applies either the ‘unknown internal sender’ policy or the ‘external sender’ policy. These are CA DLP user accounts set up specifically for this purpose.

• Network Appliance: For emails sent across your corporate network to or from the Internet, passing through the CA DLP Network Appliance, CA DLP tries to map the sender’s email address to a CA DLP user account.

  However, because the Network Appliance typically targets messages sent from private Webmail accounts, in many cases it will not be possible to map the sender’s address to a CA DLP account. In this situation, CA DLP applies either the ‘unknown internal sender’ policy or the ‘external sender’ policy.