File Type Analyzer utility cannot detect encrypted ZIP files with default script

Products

• Data Loss Prevention Endpoint Prevent
• Data Loss Prevention

Issue/Introduction

When trying to implement the File Type Analyzer utility, there are instructions which include a sample script for the detection of encrypted file types (see KB 159966 & the latest release of the Symantec DLP Detection Customization Guide for more details).

However, using the script provided, the operation fails with this error:

 

"There was an error processing the solution script you entered on line 7. Please check your syntax and try again."

Resolution

There is a known issue with the File Type Analyzer using the example script for the detection of encrypted files, as provided in the Detection Customization Guide.

Note that the issue is with the utility itself - it appears that the sample script given actually does work if used in a policy for Custom detection in Enforce.