Is it possible to detect against tracked changes in MS Word?

book

Article ID: 159657

calendar_today

Updated On:

Products

Data Loss Prevention Endpoint Prevent Data Loss Prevention Network Monitor Data Loss Prevention Network Prevent for Email Data Loss Prevention Enforce Data Loss Prevention Network Discover Data Loss Prevention Network Prevent for Web Data Loss Prevention Network Protect Data Loss Prevention Endpoint Discover

Issue/Introduction

Detecting tracked changes in Microsoft Word.

Resolution

Relevant version:  V9 and up

As of v9 there is a new setting in the Advanced Settings page on the Detection server called "ContentExtraction.TrackedChanges" that will allow you to perform matching against tracked changes in MS Word documents.  There is a corresponding change for the endpoint on the Endpoint Advanced page, Detection.TRACKED_CHANGES.str.  The two settings are independent and would need to be changed together. This will ensure that IDM policies for endpoints produce the same cracked content as other policies.

Note: These features are turned off by default because, if enabled, pre-existing IDM policies could have a lower than expected match percentage.

NOTE: If turning on tracked changes for endpoint agents, be sure to also change the monitor setting on the Endpoint Server.  This will ensure that IDM policies for endpoints produce the same cracked content as other policies.