Error: "DLP Word Plugin is tampered" when opening a Word doc file in the Outlook previewer

Products

• Data Loss Prevention Endpoint Prevent
• Data Loss Prevention

Issue/Introduction

Office plugin tampered alert when previewing an Office file (Excel, Word, PowerPoint) from within an Outlook email.
The agent goes into a warning state.

Error: Warning - DLP Word Plugin is tampered
--This happens for Excel, Word (WinWord), and PowerPoint

Steps to Reproduce

1. Single-click an Office file in an email message in Outlook so that the appropriate embedded preview loads
2. After 1 minute, the agent will go into a warning state in Enforce, e.g. "DLP Word plug-in tampered with"

07/29/2022 20:17:18 | 18420 | ADMIN | AgentServices.SystemEventLogger | Category: agent_event.category.dlp_winword_plugin_status, SubCategory: agent_event.subcategory.dlp_winword_plugin_tampered, Extended Value: Plugin Tampered

This only happens when an Office file is opened within an Outlook email, using the previewer.
It does not happen when that file is downloaded to the endpoint and opened.

Environment

Release:

Tested on agent versions 15.8 MP2 and the 15.8.00201.01003 hotfix.
Tested with the MP3 agent, the issue remains the same.

Resolution

This issue has been fixed in DLP 16.0. For DLP 15.8 Customers, please install public hotfix 15.8.00310.01004 to resolve the issue.