Titus DLP integration known limitations issue

Products

• Data Loss Prevention Endpoint Prevent
• Data Loss Prevention

Issue/Introduction

Titus labels are not being detected.

Resolution

Titus can write tags into metadata of documents and we can read those tags.

By writing your own flex-responses, you can use Titus API to write tags/labels into metadata of documents.

We integrate with Titus in two ways.

• If you turn on metadata extraction in the DLP agent configuration (Detection.ENABLE_METADATA.str), then we can see the labels which Titus adds to the custom properties of office documents for content identification.
  This works with keyword policies designed to detect the Titus labels.
  The built-in MIP classification policy rules do not detect the Titus labels, they only detect MIP classification tags/labels.
• Titus has also developed a FlexResponse in their latest version, which calls their API so that our protect functionality can add Titus tags/labels to the customer properties of Microsoft documents for classifying sensitive content found on file shares by Network Discover.
  Check with Titus for their latest version.
  Engage our Professional Services if you need Broadcom's assistance with the FlexResponse.

 

When using Titus to classify documents in combination with Symantec Data Loss Prevention metadata detection, certain tags/labels added by Titus cannot be detected. The data is stored by Titus in the XMPmetadata for PDF files which is may not be extracted by Symantec Data Loss Prevention. There is no workaround.

 

 

Additional Information

Use the filter utility to understand the metadata extracted by DLP on the tagged file. Use the '-i' & '-xmp' arguments to see the complete metadata extraction. See example below:

filter -i \temp\myfile.doc \temp\metadata_output1.txt

filter -xmp \temp\myfile.doc \temp\metadata_output2.txt