I was able to successfully deploy Symantec DLP/DCS in our existing environment with Enterprise Vault 10.0.4 and have been able to successfully test a rule with Enable Classification Test Mode.
The rule is actually really simple. I'm using the Enterprise Vault Data Classification Services Solution Pack and made a copy of the "Attorney-Client Privilege" policy and saved it so I can preserve the original - the policy compares the email addresses contained within the SMTP header for types IPM.Appointment and IPM.Note and classifies the email as an incident with high severity.
My goal is to then prevent these messages from being journaled in the same journal mailbox as all our other emails. I figured if I could simply use a response rule to mark them as "do not archive" and move them to a different journal mailbox, I would be able to journal them into their own separate vault store. The idea behind this is to prevent all privileged emails from being searchable when normal reviews are done but, if we needed to restore items or in-house counsel needed to review privileged emails, they would be searchable as long as the correct archive is selected - or, if possible, I would create a separate CA/DA customer altogether than contained only the vault store for the privileged emails - then there is no way they could be accidentally searched or be returned as hits against a seach.
I'm still reading the DCS implementation guide but while looking through the DLP admin console, a way to accomplish this doesn't seem readily apparent. Does anyone have any suggestions or guidance?
Thanks!