An issue has been discovered wherein XML containing entity references being sent through the detection server is not being cracked properly. If you find that Regular Expressions aren’t matching HTTP Posts to sites like office.microsoft.com, via office apps research feature, then capture the vpcap file.
If the XML contains entity references similar to the attached file, then the regex should be changed to look for spaces as all entity references are currently replaced with spaces.