How are IDM detections affected by ContentExtraxtion.TrackedChanges setting.

Products

• Data Loss Prevention

Issue/Introduction

in the documentation, enabling contentextraction.trackedchanges setting will have an affect on partial matching percentages of IDMs. See: https://techdocs.broadcom.com/us/en/symantec-security-software/information-security/data-loss-prevention/16-0-2/managing-detection-servers/installing-and-managing-detection-servers-and-cloud-de/advanced-detector-settings.html

 

Environment

DLP 15.8 - 16.1

Resolution

Microsoft Word supports a feature called Track Changes: Track changes in Word - Microsoft Support

Normally DLP doesn't extract the tracked changes, unless the setting ContentExtraction.TrackedChanges is enabled, which enables DLP to extract tracked changes within Microsoft Word files, if there are any.

As a simple example, suppose you index Word file "DocumentA", with a 50% match threshold for IDM. Now, by default, with TrackedChanges disabled, if someone emails a document that matches 50% of the indexed "DocumentA", there will be a match.

Suppose that someone sends a document where 50% of the live document content would match indexed file "DocumentA", but it also contains tracked changes. If you enable ContentExtraction.TrackedChanges, now the total extracted document text size goes up, which can cause the match percentage of the file being scanned to be lower (in this example lower than 50%) so there will no longer be a match at the 50% threshold.