I have DLP 12.0. When I look at an SMTP incident, my 4th tab is the Correlations Tab. In that tab, I see the Sender, Recipient, Subject, Attachments, and Policy. I'm OK with having all of that information on the tab and printed report, except for the Policy. The incident count for the Policy is cumulative for the entire enterprise, not just for the guilty sender. My manager is concerned that this may be misinterpreted by the manager of the offending sender.
Is there a way that I can customize the Correlations Tab so that it just doesn't show the Policy matches? I've tried going to Customize Layout, then clicking on Tab 4, which should be the Correlations, but nothing happens there. I can turn off the Correlations entirely by changing the drop-down for Tab 4, but that doesn't help show the sender's cumulative incident count.
Does anyone have an idea of if or how this can be done?
Thanks much...