Exclusion of email addresses in the Freeform Emails/Domain section of the Compliance Accelerator Search Criteria does not function as expected.

Problem

When a Compliance Accelerator (CA) Search is configured to run between Departments and an email address is listed as an exclusion in the 'Freeform Email Address/Domains' field, the Search results may include messages where the exclusion email address is listed as a recipient. There are specific circumstances under which this may occur, as described below.

Example Scenario

CA configuration:
- Department1 with Monitored Employee User1.
- Department2 with Monitored Employee User2
- Department3 with Monitored Employees User3, User4, User5, User6.

Each Monitored Employee is Journaled. The following test messages are sent and appropriately tagged by the Journal Connector (prior to EV and CA 11.0.1) or the EV Storage Service (starting with EV and CA 11.0.1):

- FROM User1 TO:
--- Subject: Test1; Author: User1; Recipients: User2, User3
--- Subject: Test2; Author: User1; Recipient: User2
--- Subject: Test3; Author: User1; Recipient: User3

- FROM User2 TO:
--- Subject: Test4; Author: User2; Recipients: User1, User3
--- Subject: Test5; Author: User2; Recipient: User1
--- Subject: Test6; Author: User2; Recipient: User3

- FROM User3 TO:
--- Subject: Test7; Author: User3; Recipients: User1, User2
--- Subject: Test8; Author: User3; Recipient: User1
--- Subject: Test9; Author: User3; Recipient: User2
--- Subject: Test10; Author: User3; Recipients: User4, User5
--- Subject: Test11; Author: User3; Recipients: User4
--- Subject: Test12; Author: User3; Recipients: User5.

A Search is run in Department1 that includes the following Authors And Recipients criteria:

- Authors And Recipients: Between Any Of Department1 and Any Of Department1,
Department2, Department3.
- No entries in Freeform Email Addresses/Domains.

The Search results should include messages Test1, Test2, Test3, Test4, Test5, Test7, Test8, as expected.

Another Search is run in Department 1 that includes the following Authors And Recipients criteria:

- Authors And Recipients: Between Any Of Department1 and Any Of Deptartment1,
Department2, Department3.
- Freeform Email Addresses/Domains: -"user2@evlab.com"

The results will include messages Test3 and Test8 as expected. The results will also include message Test7, which is not expected as User1 and User2 are both Recipients but User2 is excluded.
The reason message Test7 was listed as a result is explained below.

Cause

This behavior is by design.

The 'Freeform Email Address/Domains' field is designed to accommodate for external recipients who are not listed in a Department. The placement of the field on the right side of the Authors and Recipients Message Route is designed to define directional Search rules:
- when the Search direction is from left to right, the 'Freeform Email Address/Domains' field is seen as a Recipient.
- when the Search direction is from right to left, the 'Freeform Email Address/Domains' field is seen as an Author.

A Search run BETWEEN Departments is interpreted by CA as two Search Criteria sections for the Authors/Recipients:
- the first section is where the Employees in the Source Department (ie.: left side of the Authors And Recipients section) are listed as Authors, and the Employees in the Target Departments (ie.: right side of the Authors And Recipients section) as well as any entry in the 'Freeform Email Address/Domains' field are listed as Recipients.
- the second section is where the Employees in the Target Departments as well as any entry in the 'Freeform Email Address/Domains' field are listed as Authors, and the Employees in the Source Department are listed as Recipients.
The two sections are joined with the OR operator.

If an email address exclusion is listed in the 'Freeform Email Address/Domains' field, the CA Search will interpret this exclusion entry as an Author in the second section, as described above. If a Monitored Employee from the source Department is listed as a message Recipient and the email address listed as an exclusion in the 'Freeform Email Address/Domains' field is also a Recipient in the same message, that message will not be excluded from the Search results, and the message will be returned as a hit.
 

Solution

There are currently no plans to address this issue by way of a hotfix or cumulative hotfix in the current or previous versions of the software at the present time. This issue may be resolved in a future major revision of the software at a later time. However, this particular issue is not currently scheduled for any release.  If you feel this issue has a direct business impact for you and your continued use of the product, please contact your Veritas Sales representative or the Veritas Sales group to discuss these concerns.  For information on how to contact Veritas Sales, please see https://www.veritas.com.