Wrong highlighted text in the incident snapshot

Products

• Data Loss Prevention Enforce

Issue/Introduction

A user made un upload of a file with extension .asar and triggered our policy made to detect precisely the keyword “EXAMPLE”.

The issue is related to the way it appears to be in the incident snapshot in the console, because there is no “EXAMPLE” highlighted, so it looked like there was a false positive.

Then we could get the original file and we discovered there is actually the word “EXAMPLE” in the file but, as said, it is not shown in the console.

 

It was reproduced with the same file, also changing the extension to .txt.

When the file was made smaller the incident snapshot highlights the correct keyword “EXAMPLE”.

Environment

Release : 15.8

Resolution

This is anticipated to be fixed the next major release of 25.1. 

Given that it's just a difference in what is highlighted and is not a missed detection, therefore hot fixes for previous versions will not be created.