DLP 15.8 OOXML plugin is not inspecting content within XLSX files generated by certain SAP based applications.
Release: 15.8
The OOXML plugin is a wrapper around Microsoft’s Open XML SDK. The version of OOXML plugin in DLP 15.8 expects an element named <workbookPr> to be present in XML representation of XLSX documents. This element defines certain properties of the workbook such as the formatting of date information in the workbook. XLSX files generated by certain SAP based applications seem to be missing this information. Consequently, the plugin parses such files incorrectly.
This issue can be addressed either by installing DLP 15.8 MP3 Hotfix 10 or by disabling the OOXML plugin for the Detection Server and the Endpoint Agents.
DLP 15.8 MP3 HF10 is available for download in the support portal. DLP 15.8 Mp3 Hotfix 10 will allow DLP to use OOXML, instead of KeyView, to inspect XLSX files that may be missing <workbookPr> element.
These hotfixes need to be installed on all the DLP servers and the Endpoints in order to resolve the issue completely.
Note: Any detection rules that require over 90% matching of an IDM index will require re-indexing when switching between OOXML and Verity.
Detection server:
Endpoint Agents:
Overall, the OOXML and Verity plugins have the same detection capabilities including the following: Detections of Microsoft Sheets, Embedded content objects, MIP encrypted (when configured). The table below depicts the minor differences between each plugin and what to expect when changing between plugins.
|
15.8 GA |
15.8 MP3 Hotfix 10 |
16 GA |
16 MP1 |
|||||
Verity | OOXML | Verity | OOXML | Verity | OOXML | Verity | OOXML | ||
SAP Generated Excel Files |
TRUE | FALSE | TRUE | TRUE | TRUE | TRUE | TRUE | TRUE | |
Content Detection of Macros |
TRUE | FALSE | TRUE | FALSE | TRUE | FALSE | TRUE | FALSE | |
MIP Co-Author Tagging* |
FALSE | FALSE | FALSE | TRUE | |||||
Structured Data Identifiers (SDI)** |
FALSE | TRUE | FALSE | TRUE |
* MIP co-author tagging support was added with DLP16.0 MP1.
** SDIs were added in DLP 16.0.