iConsole keyword highlighting not working as expected

Products

CA Security Command Center CA Data Protection (DataMinder) CA User Activity Reporting

Issue/Introduction

From the perspective of an iConsole "reviewer", an event to be reviewed can be set up to have certain triggering words or phrases highlighted to aid the review. In some cases this is not rendered correctly. Incorrect keyword highlighting is confusing for some reviewers.

Environment

CA Data Protection 15.2

Cause

The following scenarios have been identified as causing highlighting issues.

1. When a comma is used as a delimiter for extracted text. If a comma is present in the matching token text, the application considers it as two tokens instead of a single token. As a result, iConsole renders the event and highlights the split tokens instead of a unified token with the comma present in it.

2. When a mail Event body and its summary type page is displayed in the CA Data Protection iConsole all extracted keywords are highlighted in the body or displayed in Event Summary page irrespective of a Reviewers Policy Role.

The mail event in iConsole highlights all extracted keywords in email text that have triggered policies applied to the participant. It also displays all classified as and Extracted text for all reviewers.

Resolution

FIX:SO01002 (incorporating Web_15.20_HF0177, Server_15.20_HF0174, Server_x64_15.20_HF0175 and Server_Native_x64_15.20_HF0176) has now been released to address these highlighting issues.

1: Comma in highlighted text renders incorrectly in the iConsole.

To identify the comma in the match token, it is replaced with the \, character sequence. This enables a comma used as a delimiter to be identified separately from the comma in the match text. This fix does not break any earlier functionality and earlier events generated before applying this fix still render in the old way.

Events generated after applying this fix would only have the escape character with the comma in the event match text. Also, an extra back slash with the comma is observed in the iConsole event - 'Extracted Text:' field.

2: Filtering of extracted keywords in the iConsole based on a trigger.
This hotfix includes updated binaries that ensure highlighting of keywords based on only the triggers that are allowed to be visible for a particular reviewer, based on the policy roles set.

Additional Information

NOTE: FIX:SO01002 supersedes and includes the fixes previously released in FIX:RO95477 (Web_15.20_HF045, Client_x64_15.20_HF049, Server_15.20_HF046, Server_x64_15.20_HF047)

a. The resolution to part 1 (comma issue) involves two hot fixes (server and web) which need to be applied to the two respective CA Data Protection components. Failure to apply both fixes will result in the fix not taking effect.

b. The following files will be updated when applying these hot fixes:

WebService\bin\WgnWebService.dll - 15.20.4643.0 - 15-Mar-2018
client\fkeyword.dll - 15.20.4643.0 - 15-Mar-2018
client64\fkeyword.dll - 15.20.4643.0 - 15-Mar-2018
common\Classify.dll - 15.20.4643.0 - 15-Mar-2018
common64\Classify.dll - 15.20.4643.0 - 15-Mar-2018