Unable to detect on keywords within a Powerpoint Master Slide

book

Article ID: 160692

calendar_today

Updated On:

Products

Data Loss Prevention Network Monitor

Issue/Introduction

When a keyword is embedded within a PowerPoint Master Slide, Symantec DLP is not detecting it.

Resolution

A bug for not triggering an incident when the keywords are within the Master Slide of a Power Point representation is filed under Etrack 2185114.
In Symantec DLP prior to version 12.0 there is no workaround to trigger on the keywords within the Master slide.

Symantec DLP 12.0 onward, data within Master Templates will trigger incidents when Slide Master is more than one page.
Alternative workaround to capture Slide Master data on single PPT page is to modify formats.ini

formats.ini is on Detection servers and is located In \SymantecDLP\Protect\plugins\contentextraction\Verity\x64
Add the following to formats.ini:

 [Options] 
MasterslideText=TRUE
Keep the remaining options the same.  Then save the file and restart the Vontu Monitor service.