docx or xlsx is not getting detected by Network Prevent - MICROSOFT MIME TYPES FOR CONTENT STREAMING

Products

• Symantec Products

Issue/Introduction

When attempting to detect certain Microsoft formatted documents, Network Prevent may be failing to create an incident.

No error message present in the logs.

Cause

Network Prevent ICAP uses content type for inspection, you may need to include the MIME types for your specific needs. For example, incidents may be getting triggered on .doc and not docx, or .xls and not .xlsx. In this case, you will need to add the content type for stream.

 

 

Environment

Any DLP environment using Network Prevent (ICAP).

Resolution

Access your Network Prevent server(s) from the Enforce UI, then click on the "ICAP" tab and find the text box for "Response Filtering" > "Inspect Content Type".  Add the following MIME types for the file extensions you are wanting to detect on:

 

Extension    MIME Type

.doc             application/msword
.dot              application/msword

.docx           application/vnd.openxmlformats-officedocument.wordprocessingml.document
.dotx            application/vnd.openxmlformats-officedocument.wordprocessingml.template
.docm          application/vnd.ms-word.document.macroEnabled.12
.dotm           application/vnd.ms-word.template.macroEnabled.12

.xls              application/vnd.ms-excel
.xlt               application/vnd.ms-excel
.xla              application/vnd.ms-excel

.xlsx            application/vnd.openxmlformats-officedocument.spreadsheetml.sheet
.xltx             application/vnd.openxmlformats-officedocument.spreadsheetml.template
.xlsm           application/vnd.ms-excel.sheet.macroEnabled.12
.xltm            application/vnd.ms-excel.template.macroEnabled.12
.xlam           application/vnd.ms-excel.addin.macroEnabled.12
.xlsb            application/vnd.ms-excel.sheet.binary.macroEnabled.12

.ppt             application/vnd.ms-powerpoint
.pot             application/vnd.ms-powerpoint
.pps            application/vnd.ms-powerpoint
.ppa            application/vnd.ms-powerpoint

.pptx           application/vnd.openxmlformats-officedocument.presentationml.presentation
.potx           application/vnd.openxmlformats-officedocument.presentationml.template
.ppsx          application/vnd.openxmlformats-officedocument.presentationml.slideshow
.ppam         application/vnd.ms-powerpoint.addin.macroEnabled.12
.pptm          application/vnd.ms-powerpoint.presentation.macroEnabled.12
.potm          application/vnd.ms-powerpoint.template.macroEnabled.12
.ppsm         application/vnd.ms-powerpoint.slideshow.macroEnabled.12

.mdb          application/vnd.ms-access