for Google Workspace / Microsoft 365
Question
For the email DLP service, sometimes the email address is duplicated (ex. "user@example.com" <user@example.com>). In this case, how to set the Email DLP filtering rule?
Answer
You can set by selecting "Optional Header" as the search Target and set the following conditions as the Optional Header:
◯ Optional Header:
:X-TO-ADDR …Extracts a unique email address included in TO
:X-CC-ADDR …Extracts a unique email address included in CC
:X-TO-CC-ADDR …Extracts a unique email address included in TO and CC
:X-TO-DOMAIN …Extracts a unique domain included in TO
:X-CC-DOMAIN …Extracts a unique domain included in CC
:X-TO-CC-DOMAIN …Extracts a unique domain included in TO and CC