Keyword DCM condition issue (e-mail)

Hello,

My DLP 14 (endpoint prevent license) can't differentiate the difference between the match on Body vs match on Subject for emails. I would like to create a compound that allows me to say to create an incident if the keyword X is found in Subject AND if the keyword Z is found in the body of the email.

Currently the incident is generated no matter where both keywords are found; in body OR subject.

Is this happening to someone else?

Thanks.