IDM incidents are created on whitelisted text

Products

• Data Loss Prevention Enforce

Issue/Introduction

Boiler plate text that has been added to the whitelisted.txt file to be excluded from IDM data profiles.

New incidents are observed that include the template text as a part of the IDM match percentage.

Resolution

From the DLP 16.1 Administrators Guide, an explanation of two settings that impact the the whitelisted.txt file contents.

The size of the passages depends on the low_threshold_k setting in the indexer
properties file (\SymantecDLP\Protect\config\indexer.properties). Generally,
there is no need to change the default settings. When you lower the default minimum,
the Enforce Server creates hashes out of smaller sections of the documents it
indexes.
The default settings apply to the Whitelisted.txt file as well. If the amount of
content you need to whitelist is less than the minimum amount required for partial
matching, you can adjust the default minimum setting.

The value for this parameter must match the min_normalized_size value.
 

To adjust the low_threshold_k and min_normalized_size values:

1. Edit the Indexer.properties file located here: <install Directory>\Protect\config\
2. Update the following settings with matching values: low_threshold_k, min_normalized_size
   • ​​Example: When reducing the low_threshold_k value to 25, also update the min_normalized_size value to 25.
3. Save the Indexer.properties file.
4. Restart SymantecDLPManagerServer service.
5. Re-index the document profile.

These settings are also relevant for the Remote IDM Indexer as well.