EDM Detection produces false positives for terms with apostrophe.

Products

• Data Loss Prevention Network Monitor and Prevent for Email and Web
• Data Loss Prevention

Issue/Introduction

The customer has created an EDM which contains words with an apostrophe such as the following...

tintin's

asterix's

roland's

... when the customer sends messages through detection that contain terms such as tintin, roland and asterix they will match and generate an incident which may be deemed a false positive by the customer as they are not an exact match.

The customer would like only the exact work which includes the apostrophe to match.

 

 

Resolution

Unfortunately this cannot be changed at present and is a result of the normalization process which occurs for both indexing and detection, this was a design choice in order to reduce false negatives at the expense of incurring some level of false positives. There is no fix or workaround for this and it should be regarded as expected behaviour in the product.