When multiple files are attached, DLP blocks the files one at a time.
In
mail.yahoo.com, the website does not try to continue the file uploads after the first file is blocked. Because there is no file upload operation performed by
mail.yahoo.com, DLP does not scan
other files. So, no incidents are generated.
If the same files are attached one at a time in
mail.yahoo.com, the DLP
block operation works as expected. It also provides a separate incident for each file with its own evidence object.
When Web Protection Rule is modified to
Monitor instead of
Block, an incident for each classified file is received. The classified file has its own evidence object.
