000013030 - IP addresses Content Blade

Document created by RSA Customer Support Employee on Jun 16, 2016Last modified by RSA Customer Support Employee on Apr 21, 2017
Version 2Show Document
  • View in full screen mode

Article Content

Article Number000013030
Applies ToRSA DLP 8.X, 9.X
IssueGoal detect IP address using IP Addresses Content Blade
Not able to detect single IP without descriptive term
Resolution

The IP address content blade will match IP numbers, such as 10.0.0.1 but it requires 2 or more IP addresses (with no descriptive terms) to create an event. It will match on 1 IP address only if there are terms present such as IP, TCP or subnet. The logic behind the blade:

  • one IP address and a descriptive term
    or
  • two or more IP addresses (with no descriptive terms required).
Legacy Article IDa49289

Attachments

    Outcomes