One common request I hear from clients with Symantec DLP is the ability to send a single email based on a threshold of DLP incidents.
For example, R&D analyst copies 2k files to USB within an hour. Currently, Symantec DLP would send 2k emails to the user or manager.
Ideally, Symantec DLP would send 1 email for one action of copying 2k files. Is there a feature request for this or has it been considered?
This would allow for automation when escalating DLP incidents.