Missed detection with policy and edms using where clause.

Products

• Data Loss Prevention Network Discover
• Data Loss Prevention

Issue/Introduction

When using an exception to look for a column in the where clause. The policy doesnt trigger

for example:

Environment

Symantec DLP 15.8 - 16.1

Cause

in the where clause make sure that the text in that field does not conflict with the stop words configured on the enforce server. See: 

https://knowledge.broadcom.com/external/article/160359

Resolution

Make sure that in your exception that you are not using any text that the Enforce ignores by default located in the following location:

Linux:

/opt/Symantec/DataLossPrevention/EnforceServer/<version>/Protect/config/stopwords

Windows:

%ProgramFiles%\Symantec\DataLossPrevention\EnforceServer\<version>\Protect/config\stopwords

If you are using one of the words in the stopwords.txt, the edm will need to be updated to another string value and reindexed and the where clause will also need to be updated.